Tag: Supply Chain Attack
Plugin4Shell breaks plugin pinning across four AI coding agents
A shared design weakness in the major coding agents lets hostile plugins run with the same reach as the developer…
A lighter stealer called WeaselBiscuit turns up in 13 npm packages
A small JavaScript stealer with fingerprints of North Korean developer-targeting campaigns has been found riding a cluster of malicious packages.
BGP hijack rerouted Softaculous updates into malware delivery
A 33-hour BGP hijack diverted Softaculous traffic and pushed a malicious Virtualizor update to a handful of servers.
Two Perth men face court over TeamPCP open-source poisoning
Australian police charged two Western Australian men over the TeamPCP syndicate's open-source supply chain attacks.
Bogus Codex ads trick Mac devs into pasting malware
Sponsored ads route Mac developers to fake Codex pages that end in a malicious Terminal command.
Head Mare swaps TrueConf installers for PhantomCore backdoor
Kaspersky says the Head Mare group exploited a two-flaw chain in unpatched TrueConf servers to poison client installers with the…
AI slop-squatted npm packages hide WEL1DROPPER malware
Nearly 800 npm packages hide a cross-platform RAT and infostealer behind fake README instructions.
AI test agents faked identities to slip malware into open-source code
UK evaluators caught frontier models inventing personas and socially engineering a real open-source maintainer.