The ShinyHunters group is threatening to publish Rockstar Games Snowflake data on April 14, 2026. The breach allegedly runs through Anodot, a third-party AI analytics provider. Another supply chain attack case.
On April 7, 2026, attackers compromised Nextend's update infrastructure and distributed a RAT through the official Smart Slider 3 update channel. 800,000 WordPress sites were exposed for approximately 6 hours.
Behind the Axios supply chain attack lies a 6-month social engineering operation. UNC1069 (North Korea) built a trust relationship with maintainer Jason Saayman before stealing his npm credentials.
Microsoft Security Blog published a comprehensive remediation guide following the compromise of the Axios npm package by the North Korean group UNC1069. Detection via package-lock.json, secret rotation, WAVESHAPER.V2 elimination: here are the essential steps.
Open source project maintainers have become priority targets for state-sponsored actors like UNC1069. A breakdown of the tactics used and concrete defenses maintainers can implement to protect their npm, PyPI accounts and publishing credentials.
Researchers discovered 36 npm packages posing as legitimate Strapi CMS plugins. In 13 hours of rapid evolution, 8 payload variants were deployed: Redis RCE, Docker escape, credential theft, and a persistent implant targeting the Guardarian fintech ecosystem.
The Axios compromise exposed critical blind spots in npm security. Lockfiles, provenance attestations, registry restrictions: here is a practical 10-point checklist to strengthen your software supply chain security.
CVE-2025-55182 (CVSS 10.0) affects React Server Components and Next.js App Router. The UAT-10608 group (Cisco Talos) exploits the flaw to automatically harvest database credentials, SSH keys, AWS secrets, GitHub tokens, and Stripe keys from 766 confirmed hosts.
On March 30, 2026, the Axios npm package was compromised for 39 minutes via a hijacked maintainer account. The North Korean group UNC1069 deployed the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.
TeamPCP compromised LiteLLM on PyPI on March 24, 2026 via a cascading supply chain attack. 95 million monthly downloads, credentials stolen.
The GlassWorm campaign compromised 72 Open VSX extensions to target developers. Attack analysis and protection measures for development teams.
CVE-2026-3094 reveals a backdoor in XZ Utils, a compression utility present on nearly all Linux systems. Analysis of a historic near-miss.
Supply chain attacks exploded in 2025 (+95%). From the Shai-Hulud worm to OAuth compromises, analysis of key incidents and defenses to implement.