Supply Chain & Open Source
Cybersecurity news in this category
Malicious Code Injected into LiteLLM Open Source AI Package via Supply Chain Attack
GhostAction Campaign Compromises 790 GitHub Repositories via Malicious Workflows
SberTech Launches Platform V Orchestrator for Security Services to Scan Software Before Corporate Deployment
NEC Subcontractor Suffers Cyber Attack Leading to Customer System Disruptions and Personal Data Leak
NEC disclosed that a subcontractor handling system development and maintenance was compromised in a cyber attack during late September 2026. Attackers stole legitimate account credentials and used them to access multiple customer environments from the subcontractor's systems. The intrusion resulted in server files being encrypted, rendering customer systems inoperable. Additional files containing personal information and system details were exfiltrated from a shared cloud storage platform used for coordination between NEC, the subcontractor, and customers. Affected customers have been notified individually, with further details on compromised personal data to be provided as they become available. The incident highlights risks associated with third-party vendor access in IT supply chains.
OVHcloud CLI Compromised: Infostealer Distributed Through Hijacked GitHub Releases for 25 Minutes
On October 19, the official OVHcloud CLI tool was compromised when an attacker used a hijacked developer account to replace binaries in five existing releases from v0.11.0 to v0.15.0. The attack lasted from 15:47 to 16:12 Moscow time, with the infostealer targeting API keys, SSH keys, and other secrets stored on developer and CI machines. The malicious binaries were uploaded directly via the GitHub Releases API, and the checksums.txt file was also replaced to match the tampered archives. Only users who had hardcoded the original SHA-256 hash in their CI pipelines, such as one customer who opened issue #300, detected the tampering when builds failed. The compromised account HassenBF had been infected with GlassWorm malware since March 2025, allowing persistent access until the October attack. OVH responded by deleting the malicious files at 17:21 and releasing v0.16.0 with immutable releases and attestation enabled.
Supply Chain Attacks Target Ledger Hardware Wallets with Evolving Backdoors
Ledger disclosed that sophisticated hardware backdoors discovered in multiple Nano X, Flex, and Stax devices enabled thieves to steal approximately 102 million dollars in cryptocurrency from roughly 315 accounts. The implants, initially found by hardware hacker Joe Grand in devices sold by unauthorized Southeast Asian sellers, have since appeared in units purchased from authorized resellers CryptoBilis and MediaMarkt. Later versions analyzed by Mark Karpeles feature custom flexible PCBs, LTE modules, and antennas engineered to intercept seed phrases and exfiltrate them over cellular networks. Evidence now points to deliberate compromise of the authorized supply chain rather than isolated tampering of returned units. Ledger has urged resellers to purchase only through verified channels and has suspended sales through CryptoBilis pending investigation, while users continue to report additional compromised devices across Europe.
Audit of 25 Package Managers Shows Only Two Verify Every Package's Integrity Against Compromised Repositories
A comprehensive test by Trail of Bits examined 25 popular package managers to determine whether they detect malicious code substituted by a compromised repository. The study found that fewer than half verify package integrity by default using lockfiles, and only two managers check the cryptographic hash of every downloaded package. Most managers either require manual configuration, use hashes insecurely, or lack any integrity checks even when lockfiles are present. Signature verification is even rarer, with only Go performing checks by default. The research used a Docker and mitmproxy testbed to simulate attacks while preserving realistic conditions. Results highlight significant gaps in supply-chain protections across ecosystems including JavaScript, Python, Ruby, Rust, and others. The findings also discuss limitations of current lockfile designs and emerging improvements in several communities.
Compromised ConnectWise Credential Used to Access 173 Microsoft 365 Environments in Supply Chain Attack
A compromised credential from ConnectWise Cloud Backup, formerly known as SkyKick Backup, was abused to access at least 173 partner and customer Microsoft 365 environments. Microsoft Threat Intelligence classified the incident as an active supply chain attack. The attacker bypassed password and multi-factor authentication by using a client assertion issued from the vendor environment, impersonating an already-approved application identity to obtain Microsoft Graph tokens. Access occurred on October 15 between 06:13 and 08:34 UTC, with the intruder enumerating environment identifiers sequentially at short intervals, indicating automated scripting against a prepared target list. The backup application's permissions covered Exchange, OneDrive, SharePoint, Teams, and directory information. In one environment, another vendor application was granted global administrator rights and planted secrets in two trusted applications valid until 2028. ConnectWise later disabled seven application identities, revoked affected certificates, and suspended Cloud Backup services.
OIDC Configured but GitHub Actions Still Vulnerable: Megalodon and actions-cool Attacks Expose Runner Risks
Even after widespread adoption of OIDC for temporary cloud credentials in GitHub Actions, two major attacks in May 2026 demonstrated that the approach remains insufficient on its own. Attackers compromised actions-cool/issues-helper by substituting action tags to execute malicious commits that read Runner.Worker memory. The Megalodon campaign injected malicious workflows into 5,561 public repositories, harvesting environment variables, credential files, kubeconfig, SSH keys, and OIDC tokens. OIDC eliminates long-lived AWS_ACCESS_KEY_ID secrets but leaves short-lived tokens exposed inside the runner during job execution. Four mandatory protection layers are now required: strict cloud trust policies using StringEquals on the sub claim, job-level id-token: write permissions, outbound traffic controls such as Harden-Runner, and CODEOWNERS enforcement on .github/workflows/. GitHub Environments with mandatory reviewers add an essential human-approval gate that would have disrupted the Megalodon attack path.
GitHub Repo Trap with 1774 Stars Mimics Microsoft Activation Scripts to Deliver Malware via Telegram Bot
A security researcher built a Telegram bot that daily delivers five trending GitHub repositories from trendshift.io along with README summaries. One repository named Microsoft Activation Scripts contained only a README with a reversed PowerShell command that decoded to download and execute a payload from a lookalike domain. The account was created 94 seconds before the repository and used classic one-liner installation syntax to blend with legitimate projects. Analysis of 321 trending repositories showed that simple filters such as recent account age or irm|iex patterns would incorrectly flag many legitimate projects including codex and opencode. Two independent detection rules were developed: one that normalizes and scans for obfuscated execution commands including base64, mshta, certutil and hidden window flags, and another that flags one-time owners created less than 30 days before the repository with under 10 KB of content. An additional groundedness check using the AIHOT method prevents DeepSeek from inserting unverified claims such as Ruby or Cypress into repository summaries.
GhostAction Campaign Expands to Inject Malicious GitHub Workflows Stealing AWS Keys and Tokens
The GhostAction campaign has returned with an expanded technique that targets a wider range of credentials across hundreds of repositories. On October 8, two compromised maintainer accounts injected a malicious workflow named security-audit.yml into 346 GitHub repositories, including high-profile projects such as uber/athenadriver and kitao/pyxel. The workflow disguises itself as a security audit routine and executes automatically on every code push, exfiltrating credentials via HTTP requests to attacker-controlled servers. Unlike previous waves that only harvested GitHub Actions secrets, the new version also scans the working directory and full git history for forgotten credentials in older commits. Targeted data includes AWS access keys, GitHub and GitLab tokens, Google API keys, Slack and SendGrid tokens, OpenAI and Anthropic credentials, PyPI passwords, and crates.io tokens. Since October 7, more than 500 GitHub accounts have planted similar workflows, building on earlier campaigns that affected 817 repositories in September 2025 and 772 between August and September.
Security Researcher Builds SAST Scanner for AI-Generated Code and Audits 3,800 Public Repositories
A developer released AigisSAST, a lightweight open-source static analysis tool written in pure Python with no external dependencies, specifically tuned to detect common mistakes made by AI coding assistants. The scanner was run across roughly 3,800 repositories ranging from small pet projects to popular open-source platforms. It identified thousands of potential secrets and misconfigurations, yet manual review reduced the number of genuine leaks to approximately 30 cases, mostly Telegram bot tokens, database credentials, and committed .env files. The project also examined 471 production-grade Telegram bots handling payments and VPN services, uncovering 31 repositories that exposed real credentials either in current code or in Git history. AigisSAST includes 21 detection rules, 193 regression tests, automatic remediation via the fix command, and seamless integration with GitHub Actions. The author deliberately avoided validating any discovered keys to stay within ethical research boundaries.
Vendor Responsibility in Open Source: Licensing Obligations Exposed by Sonatype Nexus Changes
The article examines how vendors building products on copyleft open source projects like Nexus Repository OSS inherit significant legal and security responsibilities under licenses such as EPL 1.0. Sonatype's February 2025 shift from regular OSS binary releases to a limited Community Edition forces downstream vendors to handle their own builds, patch porting, and compliance disclosures. This change highlights the second part of copyleft licenses that outlines obligations for distributors, including revealing modifications and assuming liability for the final product. Security implications arise because critical vulnerabilities in the upstream project must now be tracked and patched by the vendor, with delays creating measurable supply chain risks. The piece provides a practical checklist for buyers to assess licensing hygiene, SBOM availability, and vulnerability response times in any open source-based solution.
PhantomSub Campaign Deploys 101 Malicious npm Packages to Hijack WhatsApp Accounts for Unauthorized Channel Subscriptions
Researchers at OX Security uncovered 101 malicious npm packages tied to the PhantomSub campaign that abuse connected WhatsApp accounts to subscribe users to promotional channels without consent. The packages disguise themselves as modified versions of the open-source Baileys library used for WhatsApp automation. Attackers rely on authenticated sessions rather than simple package installation, allowing them to control subscriptions through lists stored on GitHub, in plaintext, or as encoded identifiers. The packages have accumulated roughly 490,000 downloads, including 116,000 in the past 30 days, though the exact number of compromised accounts remains unknown. As of 28 September, npm had removed only 16 of the identified packages. The operation ultimately benefits channels selling bots, game resources, accounts, and promotion services by inflating subscriber counts while disabling notifications to hide the activity.
AI Model Hallucinations Fuel Slopsquatting Attacks on PyPI and npm Registries
Researchers identified 139 package names consistently hallucinated by five different AI models across Python and JavaScript ecosystems. Seven of these names are already registered on PyPI and npm, including one previously used to distribute malware. The attack vector, termed slopsquatting, allows attackers to register AI-suggested package names and execute code with developer privileges during installation. One package, metro-evaluator, contained malicious code removed by npm in December 2025, while another empty package css-color-stop began receiving downloads after the list was published. Real projects such as odf and lusid now occupy names that AI models recommend, causing developers to install unrelated software. Studies show hallucination rates between 4.62% and 21.7% depending on the model, with commercial models performing better than open-source ones. The findings highlight risks when AI coding agents execute dependency installation commands without human verification.
Sapper Revives Minefield to Deliver Accurate SBOM-Based Vulnerability Impact Reports for Cyber Resilience Act Compliance
Developer Perruer has forked the archived BitBom project Minefield into a new open-source tool called Sapper, fixing critical bugs in dependency graph construction and vulnerability matching. The original Minefield used roaring bitmaps and Tarjan's algorithm to build transitive dependency caches from SBOMs in O(n + m) time, but it incorrectly interpreted SPDX edge directions from protobom 0.6, creating false cycles and massively inflating dependent package counts. Additional fixes addressed SQLite memory database pooling issues, OSV range sorting errors with Go pseudo-versions and ECOSYSTEM ecosystems, and slow OSV ingestion by adding a package name index. Sapper now produces prioritized reports using CISA KEV and EPSS scores, showing exact shortest paths from vulnerable packages to root products while respecting OpenVEX statements. The tool maintains full air-gapped operation and supports CycloneDX 1.3โ1.7 and SPDX 2.x formats. These improvements directly help organizations meet the 24-hour notification requirements under the EU Cyber Resilience Act for actively exploited vulnerabilities.
Fake Terraform Providers on HashiCorp Registry Distribute Go Malware to Developers
Cybersecurity researchers have identified Go-based malware distributed through two fake Terraform providers and two Go modules hosted on the official HashiCorp registry. The providers gocommunity-io/dockerd and kreuzwenker/docker, along with modules gocommunity.io/orderedbtree and gogets.dev/btreex, impersonate legitimate projects and represent the first documented case of malicious code being delivered via the HashiCorp registry. Attackers approach developers on LinkedIn, Facebook, and job forums using fake Web3 company profiles, then supply seemingly harmless repositories whose malicious behavior is triggered through npm or PyPI dependencies. Once executed, the malware collects hardware attributes, operating system data, hostname, and node availability before sending the information to attacker infrastructure. Command and control relies on a Slack channel polled every ten seconds and encrypted commands read from Sepolia testnet Ethereum smart contracts every three seconds, with each infected client using ephemeral key pairs for targeted delivery. The code matches the Graphalgo campaign previously documented by ReversingLabs and attributed to North Korean actors.
Challenges in Building Accurate SBOMs for C and C++ Projects Highlighted by CodeScoring Analysis
C and C++ ecosystems lack centralized package manifests, making SBOM generation far more complex than in Python, Java, or JavaScript. Libraries may arrive through system package managers like apt or dnf, build tools such as Conan and vcpkg, or direct source inclusion, with no single record of all components. CodeScoringโs Johnny agent uses eBPF to observe linker commands during builds and cross-references results with dpkg, RPM, and pkg-config metadata. The analysis distinguishes build-time SBOMs, which capture static libraries and compilation commands, from runtime SBOMs that reflect dynamic dependencies at execution. When version data cannot be verified, components are explicitly marked unresolved rather than guessed. The approach also addresses header-only libraries and patched artifacts that defeat simple hash matching.
CrowdSec Confirms Theft of Source Code from Roughly 300 GitHub Repositories via TanStack Supply Chain Attack
French cybersecurity firm CrowdSec has confirmed that attackers stole source code from approximately 300 GitHub repositories, including around 170 private ones. The breach occurred in May 2026 through a compromised TanStack component that exfiltrated an API key with read access to the private codebase. The stolen material included code for the company's SaaS console, AWS procedures, connectors, and automation tools, while the remaining repositories contained already-public open source code. No customer data, passwords, organization details, tokens, or other secrets were included in the leak, and all potentially affected credentials were immediately rotated. CrowdSec stated that the code is tightly integrated with internal systems and has largely changed over the past four months, reducing its usefulness outside the company's environment. The SaaS service code undergoes regular audits, and the company sees no immediate threat from the exposure while the investigation continues.
Dependency Confusion Attacks Let Attackers Hijack Internal Library Names in Corporate Builds
A widespread supply chain risk allows attackers to publish packages with internal company names on public registries such as npm and PyPI, causing build systems to pull malicious versions instead of internal ones. The attack works because package managers treat multiple registries as a single list and select the highest version number, with no inherent priority for internal sources. Researcher Alex Birsan demonstrated the technique in February 2021 by registering names harvested from open repositories and error messages, successfully injecting packages into builds at Microsoft, Apple, PayPal, Shopify, Netflix, Tesla and Uber. The malicious code executes during installation because setup scripts and lifecycle hooks run with the privileges of the build agent, exposing environment variables, tokens and internal network access. Mitigation requires a single internal proxy repository that never mixes public responses for internal package names, scoped namespaces bound to private registries, lock files with content hashes, and disabling install scripts where possible. The technique remains effective against any organization that lists both internal and public registries in its build configuration.
NEOMSA ESB Release Strengthens Supply Chain Security Through SBOM and Dependency Hardening
Neoflex has released a new version of its NEOMSA ESB integration platform with a primary focus on cleaning up the software bill of materials and eliminating critical and high-severity vulnerabilities. The team automated SBOM generation using CycloneDX, ran SCA scans with Grype and OWASP Dependency-Check, and performed SAST and secret scanning across all build pipelines. Instead of blindly updating to the latest versions, engineers applied minimal fixed versions for each advisory while handling complex cases involving transitive dependencies, locked files, and deprecated build tools. The effort reduced the total package count from 5,872 to 1,683 after migrating the frontend build to Vite in Camel Karavan 4.18. Remaining medium and low findings were tracked in DefectDojo with clear remediation timelines. The changes deliver measurable risk reduction for on-premise deployments in critical infrastructure and financial organizations.
CodeScoring Launches CodeScoring.Save Artifact Repository for Secure Enterprise Development
CodeScoring has introduced its own artifact storage solution called CodeScoring.Save, designed to handle packages, libraries, container images, and other software components used in development. The product targets corporate users of any size seeking a predictable and resilient repository that integrates security checks directly into storage and distribution workflows. Built in Go for modern Kubernetes environments, Save supports multiple package formats including Maven, npm, NuGet, PyPI, Go Modules, Docker/OCI, DEB, and RPM while providing proxy access to external repositories. It features role-based access, auditing, independent scaling of compute and storage layers, and native integration with CodeScoring.OSA to surface vulnerability data inside the repository itself. The company positions Save as a standalone local deployment option that can operate independently or alongside its existing OSA Proxy module to block malicious components at the repository level. Future plans include support for AI models as artifacts, starting with storage and distribution for ecosystems such as Hugging Face, along with certification for Russian secure development requirements.
WordPress to Automatically Block High-Risk Plugin Updates Before Distribution
WordPress is introducing an automated security screening process for every new plugin release before it reaches millions of sites through the WordPress.org API. Updates flagged with high risk will be blocked from automatic installation, giving developers time to address issues. Previously, only initial plugin submissions were reviewed, while subsequent versions could introduce vulnerabilities, backdoors, or malicious ownership changes without checks. Each release now undergoes a six-hour delay under the Protect The Shire initiative, where multiple AI models and Jetpack Scan analyze changes to produce a combined risk score. High-risk updates are withheld from auto-updates, and developers receive detailed reports. The system has already proven effective by catching a backdoor in a plugin with around 20,000 active installations on July 28, preventing distribution after Wordfence notification. Developers can fix problems and resubmit, or appeal results, though fixing is usually faster than manual review.
Twitch Enhanced Viewer Extension Leaks OAuth Tokens From Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue surfaced prominently in the v85.x branch where tokens were appended as the &auth= query parameter during network redirects to operator-controlled proxy servers, exposing them in clear text within proxy logs. Earlier v4.x versions had already transmitted tokens via POST requests to a set-token endpoint and backup servers on deno.dev and deno.net. A fix appeared in Firefox version 85.8.7 that stops token exfiltration by altering playlist retrieval, while a Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.
Twitch Enhanced Viewer Extension Leaks OAuth Tokens from Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue became especially severe in the v85.x branch, where tokens were appended as the &auth= query parameter during network redirects to the operatorโs proxy servers, exposing them in clear text within proxy logs. Earlier versions had already transmitted tokens via POST requests to a set-token endpoint and maintained backup endpoints on deno.dev and deno.net. A fix is available in Firefox starting with version 85.8.7, which stops token exfiltration by changing the playlist retrieval method, while a corresponding Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.
Widespread AI Outage Exposes Fragile Cloud Dependencies Behind ChatGPT, Claude and Grok
On September 3, major AI services including ChatGPT, Claude, Grok, Copilot and Gemini suffered a simultaneous outage lasting nearly four hours. The incident began around 9:30 a.m. ET with ChatGPT and rapidly spread, generating over 12,000 reports on Downdetector within twenty minutes. Industry analysis points to underlying cloud infrastructure rather than the models themselves, with Microsoft Azure and Cloudflare identified as the most likely points of failure. Developers relying on tools such as Cursor experienced immediate loss of code completion and intelligent assistance, forcing manual workflows. The event highlighted single points of failure created by heavy concentration of AI workloads on a small number of cloud providers. Security professionals are urged to map AI supply chains, prepare fallback procedures, monitor infrastructure status pages and adopt multi-vendor routing for critical operations.
Protestware: How Ideologically Motivated Attackers Compromise Open Source Code and Supply Chains
Protestware represents a growing supply chain risk where open source maintainers deliberately insert destructive or politically motivated code into widely used packages. Unlike traditional malware seeking financial gain, protestware is driven by ideological motives and can delete files, cause denial of service, or restrict functionality based on geography or locale. Notable incidents include the node-ipc and peacenotwar packages that overwrote files on systems in Russia and Belarus, the colors.js infinite loop causing DoS, and es5-ext triggering high CPU usage during specific hours or Russian locales. These attacks often hide in postinstall hooks, use geolocation checks via ipinfo.io, or activate via environment variables and timestamps. Detection requires static analysis for geo-IP logic, dynamic monitoring in sandboxes, and tools such as Software Bill of Materials and OpenSSF Scorecard. Organizations are advised to adopt Zero Trust for dependencies, pin versions, use internal artifact repositories, and follow frameworks including NIST SSDF and SLSA to mitigate risks.
Attackers Exploit Critical JFrog Artifactory Flaw CVE-2026-82329 to Forge Admin Tokens and Poison CI/CD Pipelines
A critical vulnerability tracked as CVE-2026-82329 in JFrog Artifactory is being actively exploited in the wild, allowing unauthenticated attackers with network access to generate or forge administrator tokens on self-managed installations that retain default settings. The flaw enables full authentication bypass, granting attackers administrative privileges to enumerate users and groups, access sensitive configurations, read stored artifacts, and modify security settings. The greatest risk arises when Artifactory serves as the central repository for automated CI/CD pipelines, where an attacker can replace trusted internal packages, container images, or dependencies and propagate malicious changes downstream into build runners and production environments. JFrog has released patches for multiple branches, including versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20, although patching alone does not invalidate already-issued tokens. Organizations are advised to restrict network exposure, revoke and rotate admin tokens, review audit logs for anomalous token generation and configuration changes, and validate artifact integrity across the vulnerable period. The issue does not affect JFrog Cloud instances.
Critical JFrog Artifactory Flaw CVE-2026-82329 Actively Exploited to Forge Admin Tokens in Self-Managed Deployments
A critical vulnerability identified as CVE-2026-82329 in JFrog Artifactory is being actively exploited in the wild, enabling unauthenticated attackers to generate or forge administrator tokens simply by having network access to affected instances. The flaw impacts self-managed installations that retain default configurations, a common scenario when repositories are deployed quickly and later exposed to the internet. Once administrative access is obtained, attackers can enumerate users and groups, access sensitive configurations, read stored artifacts, and modify security settings. The most severe risk arises when Artifactory automatically feeds CI/CD pipelines, allowing malicious substitution of trusted packages, container images, or dependencies that then propagate downstream into production environments. JFrog Cloud instances were already protected, while self-managed deployments require updates to specific patched versions including 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Even after patching, previously issued tokens must be revoked because their validity operates independently of the software update. Organizations are advised to restrict network exposure, rotate credentials, audit token generation logs, and validate artifact integrity for any material published during the vulnerable period.
Unicode Tricks Let Malicious Python Code Bypass Code Review
A detailed analysis shows how subtle Unicode manipulations allow code to pass human review while executing entirely different logic. The first technique replaces Latin characters with visually identical Cyrillic or other script letters inside identifiers, such as using Ukrainian 'ั' instead of Latin 'i' in an is_admin variable. Python treats these as distinct names because NFKC normalization does not map Cyrillic to Latin. The second technique inserts bidirectional override characters that reorder text for the compiler while the editor displays the intended order. The third hides zero-width characters inside string literals to break comparisons and searches. A compact Python auditor using the tokenize module and explicit character sets detects all three classes of characters. The article recommends adding such checks to CI pipelines and configuring linters including ruff and flake8 to reject suspicious commits.
redb 3.7.2 Released with Custom gRPC Protocol, Dependency Vulnerability Fixes and .NET 10 Migration
The redb ecosystem released versions 3.7.0, 3.7.1 and 3.7.2 in quick succession after 3.7.0 was withdrawn due to high-severity vulnerabilities in its .NET 9 build artifacts. NuGet audit detected issues only on full rebuilds, leading to updates for SSH.NET, Microsoft.Data.Sqlite, System.Security.Cryptography.Xml and Microsoft.Bcl.Memory across redb.Route, redb.Core, redb.Export and redb.Identity. The release introduces a native GrpcWire implementation that registers individual gRPC methods as routes on a shared Kestrel host, supports bidirectional streaming, real gRPC status codes and mTLS with pinned client certificates. redb.Route also gained a dedicated SOAP connector, Control Bus messaging for route lifecycle management and a corrected Claim Check pattern. File transports received critical fixes that prevent silent data loss when readLock and idempotency options are combined. All libraries now target net8.0;net9.0;net10.0 while host applications require .NET 10, aligning with Microsoftโs shortened support timeline for .NET 8 and 9.
Poisoned Rust Crates Execute Malware at Build Time: 245 Million Downloads Hit in Supply-Chain Attack
Three widely used Rust crates on crates.io were poisoned on August 20 with malicious versions that execute automatically during cargo build. The attack leveraged a typosquatted proc-macro1 dependency containing a build script that downloads payloads and establishes persistence. arrayref alone has accumulated 245 million downloads and is pulled automatically through caret ranges in many dependency trees. Attack infrastructure overlaps with prior campaigns attributed to Sapphire Sleet and MIDNIGHT NEPTUNE. Rust security teams yanked the malicious releases within 86-107 minutes, but the incident highlights missing publish-age controls and weak maintainer-account protections in the Cargo ecosystem.
PyPI Explores Prefix Reservation for Organizations Under PEP 752 to Prevent Name Squatting
PEP 752 proposes reserving package name prefixes for organizations on PyPI, allowing control over entire families of related package names rather than individual entries. The change addresses dependency confusion and name squatting risks where attackers register packages with familiar prefixes like google-cloud- or opentelemetry- to exploit user trust. Analysis of over 800,000 PyPI projects by CodeScoring shows that prefixes are rarely controlled by a single owner, with ecosystems like aws- managed by hundreds of accounts. The proposal introduces implicit namespaces and new metadata for clients and proxies while preserving the flat namespace model familiar to Python developers. PEP 755 will define the governance process for granting prefix rights, limiting applications to organizations and requiring clear justification. Existing packages receive backward compatibility exceptions, and the mechanism does not transfer across repositories.
Suspicious Certificate Issuer Detected in MAX Messenger Windows Update Package
A detailed observation from a security researcher highlights an unexpected change in the code signing certificate for the MAX messenger desktop client on Windows. The August update package was signed by an individual named Konstantin Syomochkin instead of the usual Communication Platform LLC. This discrepancy raised concerns about potential supply chain interference linked to recent EU sanctions against the developer. The certificate was issued shortly after sanctions and belongs to a person based in Astana, Kazakhstan, with limited public ties to the VK team. Official MSI installers downloaded directly from the MAX website remain signed by the company, while the client-triggered update differs in both version and signer. The researcher recommends that VK verify the download chain through Mail.ru trackers to rule out tampering. Installation of the update was declined pending further clarification.
LiteLLM Supply Chain Poisoning Exposes 195TB of Credentials Across 2500 Organizations
A detailed forensic report from CloudSEK and Hudson Rock reveals that attackers compromised the LiteLLM CI/CD pipeline by poisoning the Trivy security scanner dependency. The malicious Trivy tag allowed theft of PyPI publishing tokens, leading to the upload of tainted LiteLLM versions 1.82.7 and 1.82.8. Within a 40-minute attack window these packages were downloaded over 119,000 times, exfiltrating 195TB of credentials including AWS, Azure, GCP keys, GitHub tokens, SSH keys, Kubernetes configs, and AI provider API keys. NVIDIA and multiple other major technology firms were confirmed among the victims. The incident highlights critical weaknesses in dependency pinning practices and the absence of automated detection for malicious package behavior on PyPI. Experts warn that AI infrastructure components are becoming high-value targets for future supply-chain campaigns.
Linux Foundation Report Reveals Why Companies Fork Open Source Projects and Maintain Internal Patches
A new Linux Foundation Research study of 567 IT professionals shows that organizations actively modify open source components rather than using them unchanged. While 72% contribute back to projects in some form, many maintain internal forks due to missing features, integration needs, security timelines, and regulatory requirements. The average organization supports 86 internal forks, consuming over 5,000 hours per release cycle. The largest gaps between business-critical technologies and actual contributions appear in programming languages and databases. The findings highlight growing supply-chain risks when internal branches diverge from upstream projects without proper tracking of patches and commits.
Where Secrets Really End Up in Docker Images: Testing 8 Common Methods
A detailed analysis of eight different approaches for handling secrets during Docker image builds reveals that most methods leave sensitive data exposed in layers, configuration files, or build history. Experiments conducted on Ubuntu 24.04.1 LTS with Docker Engine 29.1.3 and BuildKit v0.26.2 showed that simply using RUN rm after COPY or overwriting files fails to remove secrets from immutable layers. Environment variables via ENV and build arguments via ARG both persist in image metadata and history. Only BuildKit Secrets with --mount=type=secret and multi-stage builds that avoid copying secrets into the final stage successfully prevent leakage. The study demonstrates that secrets can be extracted from saved images without running any containers. Developers are advised to adopt these two secure patterns to protect credentials in container supply chains.
Mozilla Revokes GPG Signing Key After Accidental Upload to Private GitHub Repository
Mozilla has replaced the GPG key used to sign certain Firefox and Thunderbird builds following an accidental exposure of the unencrypted secret key in a private GitHub repository. The key was intended for signing Linux archives, RPM packages, and checksum files, raising theoretical risks of supply-chain attacks through forged installers. Company audits found no evidence of external misuse, as repository access was limited to a small group of employees who already held legitimate access to the key. Most users require no action, though those manually verifying GPG signatures must import the new key along with revocation data for the old one. Linux administrators installing Firefox via RPM packages on distributions such as Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE may need to manually update the key to avoid installation failures. Thunderbird users are unaffected by the RPM issue since no official RPM packages are released for the email client. The new key remains valid until August 5, 2028, with public details available in updated KEY files and on keys.openpgp.org.
ChainDrop Malware Infects Over 1,300 npm Packages in Record Supply Chain Poisoning Campaign
Security researchers have uncovered a massive supply chain attack involving the ChainDrop malware that compromised more than 1,300 npm packages with a combined 2 billion monthly downloads. The malicious code silently steals npm tokens, GitHub credentials, and SSH keys before using stolen tokens to infect additional packages in a self-propagating loop. In a parallel incident, the Open VSX marketplace removed 77 malicious extensions that impersonated popular developer tools and harvested host and repository data. Attackers have also begun exploiting AI coding assistants through a technique called HalluSquatting, registering packages that match hallucinated names suggested by tools such as GitHub Copilot and Claude Code. The incidents highlight how modern supply chain threats now extend beyond direct dependencies to include AI-generated recommendations and automated publishing pipelines. Experts recommend strict lockfile usage, minimal token permissions, and manual verification of any package suggested by AI assistants.
Malicious VS Code Extensions Masquerading as Solidity Tools Steal Crypto Wallets, API Keys and Credentials
Two malicious Visual Studio Code extensions promoted as Solidity development utilities have been used to steal cryptocurrency wallet data from browsers along with API keys and stored credentials. The extensions, identified as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, target developers working with smart contracts and Web3 environments where sensitive tokens and sessions are commonly present. Attackers rely on the trusted VS Code marketplace to deliver the payload through a simple installation rather than any complex exploit. Once active, the extensions harvest browser-based crypto wallet information, saved credentials, environment files, SSH keys and API tokens. A single compromised workstation can therefore expose repositories, cloud services and directly drain cryptocurrency funds. Security researchers recommend immediate removal of both extensions, rotation of all accessible secrets and adoption of stricter extension allow-list policies. The incident highlights ongoing supply-chain risks in developer tooling ecosystems.
Supply Chain Attack Targets Arch Linux Community Repository
Arch Linux has temporarily suspended package adoptions in the Arch User Repository after detecting accounts taking over abandoned projects to insert malicious code. The platform later expanded the restriction by blocking all new submissions to the AUR to contain ongoing supply chain attacks. Attackers were adopting packages without active maintainers and introducing harmful changes through subsequent commits that could bypass user scrutiny due to established project history. Newly created packages containing malicious build commands, including requests for elevated privileges, were also discovered. Affected accounts have been banned and identified projects removed from the repository. The incident does not impact official Arch Linux repositories, with risk limited to community-maintained AUR packages that require manual review of PKGBUILD files before installation or updates.
Malicious npm Packages Deploy Multi-Stage Trojan with Embedded GitLab Keys
Positive Technologies researchers uncovered a campaign in which an attacker published multiple trojanized packages to the npm registry under the accounts alex05255, mdrafiqulislamrabby, b.w1001, abdev8773 and mollspotwood54400. The affected packages include svg-fetcher, tradepilot, polytrade, polymarket-kit, react-svg-chunk, gamified-trading-system, font-huge, font-hub, mdb-vite, router-processor and route-processor. Each package concatenates several constants to build a C2 URL, downloads the next stage identified as token versions 106, 107, 108 and 116, and sends the hardcoded value logo in the bearrtoken header. Later stages contain heavily obfuscated JavaScript that collects username, hostname and operating-system information before establishing a WebSocket channel for command execution. Releases 106 and 116 also embed a public-private key pair belonging to a private GitLab instance operated by the threat actor, suggesting the use of CI/CD pipelines for code obfuscation and stage generation. The findings highlight the continued risk of supply-chain attacks through popular open-source repositories and the value of automated package monitoring.
How to Audit All Python Virtual Environments for Compromised Packages Without Executing Python
The article describes a practical workflow for discovering whether any Python virtual environments contain known malicious package versions. The author maintains a registry of all .venv directories across local disks and external volumes using find commands and shell hooks. A Bash script then iterates through the registry and runs uv pip freeze against each environment to list installed dependencies without invoking the Python interpreter. This approach avoids risks highlighted by recent supply-chain attacks on packages such as LiteLLM, where even python -V or pip freeze could trigger malicious .pth files. The method also supports locating outdated packages, identifying usage of deprecated libraries, and searching project code for specific functions. Configuration settings like PIP_REQUIRE_VIRTUALENV=true and the uv tool further prevent accidental global installations.
GitHub and PyPI Introduce Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI have activated new time-based barriers to slow down supply chain attacks. Dependabot now waits a default of 72 hours before proposing version updates, while PyPI rejects new files added to releases older than 14 days. The changes target non-security version updates and attempts to poison older stable releases. Security updates remain immediate, and the cooldown can be adjusted via dependabot.yml. The PyPI restriction, effective since July 8 2026, addresses risks from compromised tokens or CI/CD pipelines. Both platforms aim to give the community time to detect malicious packages before widespread adoption.
Container Image Risks: Why Skipping Verification Today Breaks Your Service Tomorrow
Technical leader Nikita from Cloud.ru details four recurring container security failures observed across client environments. The article examines untracked vulnerabilities in high-privilege components such as the NVIDIA GPU operator, supply-chain compromises affecting even trusted tools like Trivy, persistent secret leakage patterns, and CI/CD pipeline exposure. Real incidents include a 2025 NVIDIA container toolkit exploit that enabled lateral movement to worker nodes and a 2026 Trivy GitHub compromise that poisoned over seventy image tags. The author stresses that pinning to image tags is insufficient and recommends full SHA256 hashes, private registries with caching, Cosign signatures validated by Kyverno or Connaisseur, and pre-commit secret scanning. Practical recommendations include automated CVE notifications and immediate patching of privileged components rather than waiting for sprint cycles.
Should Python Libraries Raise Minimum Dependency Versions to Block Vulnerable Releases?
Seth Larson of the Python Software Foundation argues that library maintainers should not automatically raise the minimum allowed version of a dependency after a vulnerability is disclosed. He states that dependency metadata exists to declare compatibility, while security decisions belong to the application owner who controls the final build. The recommendation has sparked debate in the Python community, with some maintainers supporting the separation of concerns and others viewing security constraints as part of library support obligations. CodeScoringโs analysis examines the practical impact on the ecosystem, noting that over 10,000 packages depend on urllib3 and tens of thousands more rely on numpy, requests, and pandas. The piece concludes that version bounds may incorporate security considerations only after evaluating real usage, affected versions, and downstream compatibility, but they cannot replace application-level vulnerability management with lockfiles and tools such as pip-audit.
Corporate Nextcloud Security Gaps: Default Settings, Antivirus Failures and Open Source Integration Challenges
A detailed analysis from K2Tech reveals that corporate Nextcloud deployments require extensive security hardening beyond default open source configurations. The article examines integration with LDAP, WAF, Anti-DDoS and multiple antivirus engines including ClamAV, Kaspersky Scan Engine and PT Sandbox over ICAP. Critical issues include antivirus plugins bypassing scans during unreachable states or chunked file uploads via MOVE commands, allowing infected files to reach S3 storage. Performance tests on identical 4 vCPU and 16 GB RAM hardware showed Kaspersky Scan Engine delivering the highest throughput while PT Sandbox imposed heavy CPU loads. The piece also covers architecture spanning MariaDB Galera, Redis, Elasticsearch and multi-AZ S3, plus the need for custom parameter tuning and continuous testing due to frequent Nextcloud releases. Overall, the report emphasizes that true corporate-grade security for open source file sharing demands significant post-installation effort and monitoring.
FakeGit Campaign Floods GitHub with 7,600 Fake Repositories to Distribute SmartLoader Malware
The FakeGit operation has created or repurposed approximately 7,600 repositories on GitHub to trick users and automated agents into downloading SmartLoader, a loader that installs additional malware including the StealC infostealer. Attackers clone legitimate projects, replicate documentation and developer profiles, and host malicious ZIP files in GitHub Releases that have already accumulated over 14 million downloads across roughly 200 repositories. A notable tactic called AgentBaiting targets AI systems by disguising more than 800 repositories as AI Skills or MCP servers, leading tools from Anthropic, Google, and OpenAI to recommend malicious packages. The infection chain uses LuaJIT to execute obfuscated Lua scripts that deploy SmartLoader, which establishes persistence via scheduled tasks and resolves command-and-control infrastructure through a blockchain dead drop on Polygon. Over 600 listings linked to the campaign have also appeared on public directories such as LobeHub, Glama, and MCP Market, extending the reach beyond GitHub. Defenders are advised to maintain approved catalogs of AI components, apply application control policies, and monitor for LuaJIT execution and anomalous outbound traffic.
Securing CI/CD in Open Source Projects: Ciliumโs Final Guide to Credentials, Verification, and Remaining Gaps
VK Cloud has published the third and final part of its translated Cilium series on protecting the software supply chain in open source projects. The article details how Cilium isolates CI and production credentials using separate GitHub environments, enforces keyless signing with Sigstore Cosign and SBOM attestations, and applies strict release controls that prevent compromised workflows from reaching production images. It also covers the teamโs ongoing security operations, additional hardening measures such as immutable tags and mandatory DCO sign-offs, and a gap analysis against OpenSSF Scorecard and SLSA standards. The post examines GitHubโs 2026 Actions security roadmap and explains how planned platform features like dependency blocking, scoped secrets, and native egress firewalls align with Ciliumโs existing controls. The piece concludes by emphasizing defense-in-depth and the importance of openly sharing supply-chain security practices across the open source community.
Understanding SCA: How Software Composition Analysis Helps Manage Software Supply Chain Risks
Software Composition Analysis (SCA) has emerged as a critical tool for organizations seeking to understand and control the risks hidden within modern applications built from third-party components, open-source libraries, container images, and transitive dependencies. SCA tools scan projects to identify components, versions, dependency chains, known vulnerabilities, and license issues, providing visibility that traditional security methods often miss. The approach supports SBOM generation and integrates with standards such as SPDX, CycloneDX, and VEX to improve transparency across the software supply chain. Organizations use SCA throughout the development lifecycleโfrom dependency selection and build-time gating to post-release monitoringโto reduce reaction time when new vulnerabilities appear and to manage technical debt, licensing conflicts, and abandoned packages. In regulated environments, including compliance with Russian standards like GOST R 56939-2024 and FSTEC requirements, SCA helps teams demonstrate control over software composition and prepare evidence for certification. While powerful, SCA is not a silver bullet: it relies on accurate data, cannot detect zero-days, and requires careful policy tuning to avoid alert fatigue or developer workarounds.
Cyberattack on Nichirei Logistics Group Disrupts Frozen Food Deliveries to KFC Japan and Thousands of Restaurants Nationwide
A cyberattack on Nichirei Logistics Group, Japan's largest operator of refrigerated and frozen logistics, forced the company to shut down critical systems on July 13, halting operations across its network of 140 cold storage distribution centers. The incident quickly impacted major clients including KFC Japan, which serves more than 1,300 restaurants, leading to shortages of chicken and other ingredients needed for its Original Recipe. Other affected companies include Hotto Motto, Yayoi Ken, Kura Sushi, Aeon supermarkets, and TableMark, all of which reported delivery delays or product shortages. Nichirei confirmed that personal data was stored on some compromised servers and notified Japan's data protection authority while promising to disclose any confirmed breach. The company has not identified the attackers, disclosed the intrusion method, or confirmed whether ransomware was involved, citing security reasons for withholding technical details. Recovery efforts are scheduled to begin gradually on July 17, though a full return to normal operations has not yet been announced.
No Hacker Genius Needed: One Login and 49 Minutes Suffice in Injective Supply Chain Attack
A routine update to the @injectivelabs/sdk-ts library for Injective blockchain wallets turned into a supply-chain trap within 49 minutes, stealing users' recovery phrases and private keys. The malicious version 1.20.21 was published on npm on July 8, 2026, after attackers compromised a long-trusted maintainer account and pushed code directly to the main branch. The backdoor, disguised as anonymous performance statistics collection, activated only when applications called PrivateKey.fromMnemonic() or PrivateKey.fromHex(), exfiltrating sensitive data via the X-Request-Id header to an attacker-controlled server mimicking Injective infrastructure. Eighteen Injective Labs packages were affected, with 87 downstream dependencies also pulling in the compromised library, which sees roughly 175,000 monthly downloads. Although developers rolled back the changes and released clean version 1.20.23 within 49 minutes, at least 310 malicious downloads were recorded, and cached copies may persist in build environments. Security researchers from Datadog, Socket, StepSecurity, and OX Security have advised immediate migration to the patched release and full key rotation for any wallets that interacted with the tainted code.