Supply Chain Attack

Editorial illustration of seven npm package boxes wired to a blockchain-link control node, marking the ViteVenom campaign against Vite frontend tooling.

Supply Chain Attack

Checkmarx Documents “ViteVenom” Campaign Compromising Seven Vite npm Packages With Blockchain C2

Another JavaScript-ecosystem compromise with a novel blockchain-C2 angle — seven scoped npm packages impersonating the Vite tooling namespace, and defender inventory work this weekend.

Editorial illustration of a magnifying glass over an npm package revealing an import-time fuse, marking Microsoft's deep-dive on the AsyncAPI npm compromise.

Supply Chain Attack

Microsoft Publishes Deep-Dive Analysis of AsyncAPI npm Supply-Chain Compromise

Microsoft goes deep on the AsyncAPI npm compromise — a defender review for CI/CD workflows and @asyncapi dependencies this week.

Editorial illustration of a refrigerated truck with a cut cold-chain line and an empty food bucket, marking the Nichirei attack that disrupted KFC Japan.

Supply Chain Attack

Cyberattack on Nichirei Logistics Disrupts KFC Japan and Cold-Chain Deliveries

A cold-chain cyberattack ripples into KFC Japan and supermarket supplies — supply-chain sector-advisory coverage this week.

Editorial illustration of an npm package emitting nested loader boxes toward a node cluster, marking compromised @asyncapi packages delivering a botnet loader.

Supply Chain Attack

Compromised @asyncapi npm Packages Deliver Multi-Stage Botnet Loader

Another JavaScript-ecosystem supply-chain compromise, confirmed by four vendors: four @asyncapi npm packages were observed distributing a multi-stage botnet loader, and all five malicious versions have since been pulled from npm — defender inventory work this week.

Editorial illustration of many package boxes merging into a wave bending a server, representing 148 malicious npm packages building a browser DDoS botnet.

Supply Chain Attack

148 npm Packages Disguised as Student Proxies Reportedly Turned Browsers Into a DDoS Botnet

A large-scale JavaScript-ecosystem supply-chain compromise — defender inventory work this week.

Editorial illustration of a code editor's play button pressing itself, wired to a repository crate, representing Cursor IDE auto-executing poisoned repos.

Artificial Intelligence (AI)

Cursor IDE Auto-Executes Malicious Code in Poisoned Repositories, Researchers Say

An AI-IDE supply-chain finding — defender review for organizations using Cursor this week.

Editorial illustration of a card-catalog drawer with a faint duplicate card, representing the MemGhost persistent false-memory attack on AI agents.

Artificial Intelligence (AI)

Researchers Disclose “MemGhost,” a Technique That Plants Persistent False Memories in AI Agents

Another AI-agent supply-chain finding — defender posture review for organizations deploying memory-enabled agents this week.

Flat white line-art of a magnifying glass scanning a grid of organization cards — GitHub organization mapping reconnaissance campaign.

Supply Chain Attack

'Ghost Accounts' Abuse GitHub API in Mass Reconnaissance Campaign, SecurityWeek Reports

A GitHub-organization reconnaissance campaign — defender posture and account-hygiene review this week.

Flat white line-art of an open package box linked to a document card — jscrambler 8.14.0 npm release compromise.

Supply Chain Attack

jscrambler 8.14.0 npm Release Compromised to Drop a Rust Infostealer at Install

Another JavaScript-ecosystem SDK compromise — defender inventory work continues this week.

Flat white line-art of a code package box linked by a single line to a wallet outline — Injective Labs npm SDK compromise.

Supply Chain Attack

Compromised Injective Labs GitHub Repo Used to Publish Wallet-Key-Stealing npm Package

Another JavaScript-ecosystem SDK compromise with cryptocurrency-user implications — defender inventory work this week.

Flat white line-art of a package box beside a large toggle switch flipped to off — npm 12 disables install scripts by default.

Supply Chain Attack

npm 12 Ships With Install Scripts Disabled by Default to Cut Supply-Chain Risk

A meaningful ecosystem-policy signal from npm after months of contributor-account compromises — defender developers review CI/CD posture this week.

Flat white line-art of a robot assistant handing over a labeled package card — researchers disclose the HalluSquatting AI coding-assistant technique.

Supply Chain Attack

Researchers Disclose "HalluSquatting" Technique Targeting AI Coding Assistants

An AI-hallucination supply-chain finding with organization-wide implications — defender review this week.

See all