supply chain attack

Craneware, a healthcare finance software provider used by approximately 2,000 US hospitals, disclosed a breach on July 20 where hackers…

A hacking group is exploiting the update system of ViPNet private networking software to infiltrate Russian government agencies, state-owned enterprises,…

A financially motivated Russian-speaking cybercriminal created 292 fraudulent GitHub repositories impersonating hundreds of brands, luring victims with fake "secure download"…

A security breach at Suno exposed internal data confirming the company scraped audio from YouTube Music, Deezer, and other services,…

Klue confirmed a security breach where attackers stole OAuth tokens from client Salesforce integrations after gaining access through a compromised…

At least 15 malicious plugins on the JetBrains Marketplace, masquerading as AI coding assistants and tools, have been discovered stealing…

Attackers compromised over 400 packages in the Arch Linux User Repository (AUR) to deploy a Rust-based credential stealer, which can…

On June 1, 2026, over 30 npm packages tied to Red Hat Cloud Services were compromised in a supply chain…

A malicious npm package named "codexui-android", with 29,000 weekly downloads and a legitimate appearance, secretly exfiltrated developer authentication tokens for…

GitHub confirmed a security breach after TeamPCP infiltrated its internal repositories via a compromised VS Code extension installed by an…

A GitHub employee's device was compromised after installing a malicious VS Code extension, leading to approximately 3,800 internal repositories being…

GitHub confirmed a breach that compromised approximately 3,800 internal code repositories after an employee's device was infected through a malicious…

The ransomware group Nitrogen claims to have stolen 8 TB of sensitive data, including schematics from major clients like Apple…

Disc Soft released a clean Version 12.6 of Daemon Tools Lite on May 5, just 12 hours after discovering a…

DAEMON Tools Lite was compromised in a supply chain attack affecting free version 12.5.1 installers served from the official website…

Trellix confirmed a data breach where unauthorized actors accessed a portion of its source code repository, with no evidence yet…

The GlassWorm campaign has deployed 73 sleeper extensions on the OpenVSX ecosystem, with only 6 activated so far delivering malware,…

Boost Security has launched SmokedMeat, an open-source framework that actively simulates end-to-end attack chains against an organization's own CI/CD infrastructure…

Hackers breached cloud platform Vercel by exploiting an employee's compromised Google account, which was linked to a third-party app from…

The official CPUID website, known for tools like HWMonitor, was compromised earlier this year, redirecting users to credential-stealing malware for…