#supply-chain
-
A Leaked LiteLLM Master Key Turned Into a Poisoned Python Release
A master key accidentally published in May was never actually revoked — and in October an attacker used it to hijack LiteLLM's release pipeline and push a malicious version of the package.
-
Hijacked account: five OVHcloud CLI releases swapped for secret-stealing malware
An attacker used a hijacked contributor account to replace the archives in five releases of OVHcloud's command-line tool. The malicious build stole secrets from disk and was live on GitHub for just 94 minutes.
-
WordPress SEO plugin Rank Math PRO turned its own update channel into a backdoor pipeline
Copies of the paid Rank Math PRO plugin downloaded or delivered as an update between 20:02 UTC on October 15 and 07:12 UTC on October 16 carried malware. Any site that installed and activated one should be treated as compromised.
-
Fake Web3 Accelerator Pushed Malicious npm Packages Posing as Free AI Credits
A crew masquerading as a venture accelerator for crypto startups spread infostealers and backdoors through npm, dangling free Claude and Gemini credits — while quietly hijacking the traffic of AI agents.
-
Malicious npm Package imgdecode Hides a Shellcode Loader in a Windows Native Addon
SafeDep researchers flagged imgdecode, an npm package that is part of the long-running MALFEX campaign aimed at compromising Windows systems. Despite public exposure, it remains available and has already been downloaded 979 times.
-
Stolen ConnectWise Credential Opens Door to 173 Microsoft 365 Tenants
Attackers abused a compromised ConnectWise Cloud Backup credential to sign in to its customers' Microsoft 365 environments, inheriting the legitimate app's sweeping permissions.
-
AOMEI Backupper Update Servers Tampered With in 5–10 Minute Windows to Push a Backdoor
Between May and July 2026 attackers repeatedly swapped the update files served from AOMEI's own servers, so the Windows backup program only downloaded a backdoor during those brief intervals.
-
Backdooring Open-Weight AI Models: the Hidden Cost of "Uncensored" Builds
Any model with edited weights can carry a hidden backdoor. Researchers built a poisoned model for next to nothing and made it steal a project's credentials straight through the Codex CLI.
-
Budget Android Phones Arrive With Malware Already Built Into the Firmware
Bitdefender has uncovered Midnight Mimosa, malware baked into the firmware of cheap Android phones that turns them into residential-proxy nodes and ad-fraud tools.
-
Ledger confirms spy-chip implant behind crypto wallet thefts
Some Ledger devices sold through Malaysian reseller CryptoBilis carried a hidden spy chip that captured the seed phrase and drained their owners' crypto.
-
Compromised GitHub Actions brought back online with malware still attached
Two third-party GitHub Actions infected in May's Mini Shai-Hulud campaign were re-enabled and kept serving the old malicious payload for more than a week.
-
Schneier: Defense-Evading Malicious npm Packages Feel Like Nation-State Work
Bruce Schneier flagged a set of malicious npm packages built to slip past defenses. Their sophistication, he says, hints at a nation-state — though there is no direct evidence and no attribution.
-
Malware Sneaks Into HashiCorp Registry via Rogue Terraform Providers
Researchers found Go-based malware distributed through two Terraform providers and two Go modules in the HashiCorp registry — the first time the centralized repository has been used as a delivery channel for malicious payloads.
-
BigCommerce warns merchants of breach tied to Ribon apps
BigCommerce has alerted merchants to a breach after attackers stole credentials for the third-party Ribon apps and used them to inject malicious scripts into online stores.
-
North Korea's Jade Sleet Hits Indian IT Provider With FLATROOF and ROOFDECK Backdoors
SentinelOne has linked the Jade Sleet group to a breach of a small Indian IT firm using macOS backdoors already seen in the KelpDAO bridge attack. The case again shows that developers remain North Korea's favourite way in.
-
Malicious npm packages slip past install-script defenses by hiding in runtime code
The indexed-btree package poses as the popular sorted-btree library and hides its malicious loader not in install scripts but in an ordinary method that runs during normal application use.
-
Plugin4Shell: Swapping Out a "Pinned" Plugin in Four AI Coding Agents
Air Security has described a vulnerability that lets the owner of a plugin repository slip malicious code to an AI agent even where the plugin is bound to a specific, verified version.
-
PhantomRaven: An AI-Written npm Stealer Built to Chase Bug Bounties
CrowdStrike has linked a financially motivated threat actor to malicious npm packages that stole developer tokens. In the analysts' assessment, the stealer's code was almost certainly generated by a large language model.
-
CrowdSec confirms source code leak from private repositories
CrowdSec has disclosed that part of its source code was leaked in May 2026. By its own assessment, customer data was not affected, and the likely point of entry was a compromised TanStack library.
-
Brevo supply-chain attack: a stolen Cloudflare key infected customer sites
Attackers stole a Cloudflare API key and used an edge worker to inject ClickFix scripts into Brevo's sites and into widgets embedded on customer pages. Up to 100,000 sites may have been affected.
- More