Cybersecurity articles in Supply Chain on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/cisa-s-updated-sbom-guidance-enhancing-software-supply-chain-transparencyhttps://runtimerebel.com/blog/cisa-s-updated-sbom-guidance-enhancing-software-supply-chain-transparencyCISA has released updated SBOM guidance, refining field definitions for greater software supply chain transparency. Debate continues on its impact on risk management.Sat, 01 Aug 2026 10:01:00 GMTSBOMCISASoftware Supply ChainGuidanceCybersecurity Policyhttps://runtimerebel.com/blog/adform-script-poisoning-crypto-wallet-swapping-attackhttps://runtimerebel.com/blog/adform-script-poisoning-crypto-wallet-swapping-attackAdform's JavaScript was poisoned to swap crypto wallet addresses on customer sites. Understand this supply chain attack and how to protect against client-side script…Sat, 01 Aug 2026 10:00:39 GMTAdformJavaScriptCryptocurrencyWallet SwappingSupply Chain AttackClient Side Attackhttps://runtimerebel.com/blog/north-korean-hackers-exploit-npm-supply-chain-debug-chalk-under-attackhttps://runtimerebel.com/blog/north-korean-hackers-exploit-npm-supply-chain-debug-chalk-under-attackAmazon links North Korean hackers to supply chain attacks on popular npm packages Debug and Chalk, highlighting nation-state threat to open-source ecosystems.Thu, 30 Jul 2026 21:12:11 GMTNorth Korean HackersNPMSupply Chain AttackDebugChalkSoftware Supply Chain Securityhttps://runtimerebel.com/blog/defending-against-the-1444-surge-in-open-source-supply-chain-attackshttps://runtimerebel.com/blog/defending-against-the-1444-surge-in-open-source-supply-chain-attacksGTIG reports a massive 1,444% spike in open source repository compromises. Learn how to mitigate threats from actors like UNC6780 and MIDNIGHT NEPTUNE.Thu, 30 Jul 2026 14:10:41 GMTUNC6780MIDNIGHT NEPTUNEOpen Source SecurityGitHub ActionsNPM Securityhttps://runtimerebel.com/blog/fcc-blocks-foreign-robots-and-power-inverters-via-covered-listhttps://runtimerebel.com/blog/fcc-blocks-foreign-robots-and-power-inverters-via-covered-listThe FCC has added foreign-produced mobile robots and networked power inverters to the Covered List, citing supply chain risks and national security concerns.Thu, 30 Jul 2026 10:26:21 GMTFCCCovered ListMobile RobotsPower InvertersSupply Chain SecurityNational Securityhttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-rathttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-ratBeta versions of @joyfill/layouts and @joyfill/components npm packages compromised to deliver a DEV#POPPER RAT upon import. Node.js users at risk.Wed, 29 Jul 2026 06:32:18 GMTJoyfillNPMSupply Chain AttackRATDEV POPPERNode Jshttps://runtimerebel.com/blog/cubepilot-dns-hijacking-how-attackers-intercepted-uav-flight-datahttps://runtimerebel.com/blog/cubepilot-dns-hijacking-how-attackers-intercepted-uav-flight-dataCubePilot drone software developer hit by DNS hijacking attack. Learn how to detect the exploit and verify ArduPilot firmware integrity in this guide.Wed, 29 Jul 2026 02:45:31 GMTCubePilotDNS HijackingUAV SecurityArduPilotSupply Chain Attackhttps://runtimerebel.com/blog/github-and-pypi-policy-updates-target-supply-chain-securityhttps://runtimerebel.com/blog/github-and-pypi-policy-updates-target-supply-chain-securityGitHub and PyPI introduce new restrictions to thwart supply chain attacks, including a Dependabot cooldown and limits on historical package file uploads.Mon, 27 Jul 2026 14:40:00 GMTGitHubPyPISupply Chain SecurityDependabotOpen Sourcehttps://runtimerebel.com/blog/lookout-msec-tackling-supply-chain-risks-via-mobile-app-sbomshttps://runtimerebel.com/blog/lookout-msec-tackling-supply-chain-risks-via-mobile-app-sbomsLookout launches the Mobile Security Exposure Center (MSEC) to provide visibility into vulnerable third-party components and mobile app dependencies via SBOMs.Mon, 27 Jul 2026 11:26:52 GMTLookout MSECSBOMMobile App SecuritySupply Chain SecurityApplication Riskhttps://runtimerebel.com/blog/github-dependabot-3-day-cooldown-mitigating-supply-chain-attackshttps://runtimerebel.com/blog/github-dependabot-3-day-cooldown-mitigating-supply-chain-attacksGitHub introduces a 3-day cooldown for Dependabot to prevent the rapid adoption of malicious packages, enhancing supply chain security for developers.Mon, 27 Jul 2026 11:25:20 GMTGitHubDependabotSupply Chain SecurityMalicious PackagesOpen Sourcehttps://runtimerebel.com/blog/vs-code-marketplace-abuse-detecting-malicious-developer-extensionshttps://runtimerebel.com/blog/vs-code-marketplace-abuse-detecting-malicious-developer-extensionsResearchers identify malicious Visual Studio Code extensions exfiltrating source code and credentials. Learn how to secure your development environment.Mon, 27 Jul 2026 03:19:47 GMTVS CodeMarketplace SecurityDeveloper SecuritySupply Chain AttackCredential Thefthttps://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attackshttps://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attacksGitHub and PyPI introduce time-based delays in Dependabot to mitigate supply chain attacks by preventing the immediate ingestion of malicious packages.Sun, 26 Jul 2026 17:03:02 GMTGitHubPyPIDependabotSupply Chain SecurityPythonhttps://runtimerebel.com/blog/github-actions-runners-weaponized-to-attack-cpanel-and-whm-servershttps://runtimerebel.com/blog/github-actions-runners-weaponized-to-attack-cpanel-and-whm-serversAttackers are leveraging GitHub Actions runners and compromised Packagist packages to launch distributed attacks against cPanel and WHM server instances.Thu, 23 Jul 2026 14:05:01 GMTGitHub ActionsPackagistcPanelWHMSupply Chain AttackPHPhttps://runtimerebel.com/blog/trojanized-newtonsoft-json-fork-game-rigging-via-nuget-typosquattinghttps://runtimerebel.com/blog/trojanized-newtonsoft-json-fork-game-rigging-via-nuget-typosquattingA trojanized 'Newtonsoftt.Json.Net' NuGet package, disguised as 'Newtonsoft.Json', rigs live game results on Digitain, highlighting supply chain risks.Wed, 22 Jul 2026 06:29:48 GMTNewtonsoft JsonNuGetTyposquattingSupply Chain AttackDigitainMalwarehttps://runtimerebel.com/blog/sandworm-s-ai-toolchain-threat-detecting-sandworm-modehttps://runtimerebel.com/blog/sandworm-s-ai-toolchain-threat-detecting-sandworm-modeAnalyzing Sandworm's potential to compromise AI/ML supply chains via the 'SANDWORM_MODE' attack method, focusing on detection and mitigation strategies.Tue, 21 Jul 2026 17:24:33 GMTSandwormAPT28Supply Chain AttackAI SecurityMachine LearningOpen Source SecuritySANDWORM MODEhttps://runtimerebel.com/blog/hugging-face-infrastructure-breach-analyzing-autonomous-ai-agent-ttpshttps://runtimerebel.com/blog/hugging-face-infrastructure-breach-analyzing-autonomous-ai-agent-ttpsHugging Face discloses a breach where autonomous AI agents compromised production infrastructure, exposing internal datasets and secrets. Learn how to mitigate.Mon, 20 Jul 2026 14:19:12 GMTHugging FaceAutonomous AI AgentCredential ExposureMLOps SecurityData Breachhttps://runtimerebel.com/blog/sleepergem-malicious-rubygems-target-developer-environmentshttps://runtimerebel.com/blog/sleepergem-malicious-rubygems-target-developer-environmentsThe SleeperGem supply chain attack uses malicious RubyGems packages like git_credential_manager to compromise developers and deliver secondary payloads.Mon, 20 Jul 2026 06:48:55 GMTRubyGemsSleeperGemGit Credential ManagerSupply Chain AttackMalwarehttps://runtimerebel.com/blog/malicious-vite-npm-packages-deliver-rat-via-blockchain-c2https://runtimerebel.com/blog/malicious-vite-npm-packages-deliver-rat-via-blockchain-c2Seven malicious npm packages target Vite frontend projects. Dubbed ViteVenom, this software supply chain attack uses a four-tier blockchain C2 to deploy a RAT.Fri, 17 Jul 2026 20:57:56 GMTViteVenomChainVeilNPMViteSoftware Supply Chain AttackRATBlockchain C2https://runtimerebel.com/blog/risk-ledger-secures-32m-series-b-for-supply-chain-risk-platformhttps://runtimerebel.com/blog/risk-ledger-secures-32m-series-b-for-supply-chain-risk-platformRisk Ledger raises $32 million in Series B funding to scale its collaborative supply chain security platform, addressing critical third-party risk management.Fri, 17 Jul 2026 10:00:13 GMTRisk LedgerSupply Chain SecurityTPRMSeries B FundingCyber Risk Managementhttps://runtimerebel.com/blog/asyncapi-npm-packages-infected-with-credential-stealing-malwarehttps://runtimerebel.com/blog/asyncapi-npm-packages-infected-with-credential-stealing-malwareFive malicious versions of AsyncAPI npm packages deployed a credential-stealing remote access trojan via a supply chain attack. Learn detection and mitigation.Wed, 15 Jul 2026 17:20:00 GMTNPMAsyncapiSupply Chain AttackCredential StealingMalwareTrojanhttps://runtimerebel.com/blog/2-click-cursor-exploit-dev-environment-takeover-risks-mitigationshttps://runtimerebel.com/blog/2-click-cursor-exploit-dev-environment-takeover-risks-mitigationsAnalyze the '2-click cursor exploit' leveraging 'age-old bugs' to compromise developer environments, risking source code and IP theft.Wed, 15 Jul 2026 13:49:23 GMTDeveloper EnvironmentsSupply Chain SecurityApplication SecurityExploitationSource Code Thefthttps://runtimerebel.com/blog/compromised-asyncapi-npm-packages-deliver-multi-stage-botnet-malwarehttps://runtimerebel.com/blog/compromised-asyncapi-npm-packages-deliver-multi-stage-botnet-malwareOfficial AsyncAPI npm packages have been compromised to distribute botnet malware. Learn how to detect and mitigate these supply chain attacks.Wed, 15 Jul 2026 10:04:34 GMTNpm MalwareAsyncapiSupply Chain AttackBotnetJavascript Securityhttps://runtimerebel.com/blog/jscrambler-npm-packages-poisoned-in-supply-chain-attackhttps://runtimerebel.com/blog/jscrambler-npm-packages-poisoned-in-supply-chain-attackAttackers poisoned official Jscrambler NPM packages to distribute cross-platform credential stealers. Learn the impact and how to remediate the threat.Tue, 14 Jul 2026 10:01:24 GMTJscramblerNPMSupply Chain AttackMalwareCredential Stealerhttps://runtimerebel.com/blog/xai-grok-build-repository-upload-risks-analyzing-cli-data-exposurehttps://runtimerebel.com/blog/xai-grok-build-repository-upload-risks-analyzing-cli-data-exposurexAI's Grok Build CLI version 0.2.93 discovered uploading entire Git repositories, including history and secrets, to remote storage without user consent.Tue, 14 Jul 2026 09:59:54 GMTXaiGrok BuildGit SecurityData ExfiltrationAI Securityhttps://runtimerebel.com/blog/klue-security-incident-analyzing-third-party-supply-chain-impacthttps://runtimerebel.com/blog/klue-security-incident-analyzing-third-party-supply-chain-impactAn analysis of the Klue security incident affecting Recorded Future, highlighting the risks of third-party SaaS vendors and competitive intelligence data.Tue, 14 Jul 2026 06:12:08 GMTKlueRecorded FutureSupply Chain RiskSaaS SecurityThird Party Breachhttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwarehttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwareA malicious version of the Jscrambler npm package, 5.0.0-beta-1, was backdoored with infostealer malware, affecting 1,500 downloads. Immediate action needed.Mon, 13 Jul 2026 20:59:06 GMTJscramblerNPMSupply Chain AttackInfostealerMalwareNode Jshttps://runtimerebel.com/blog/modheader-extension-pulled-over-dormant-browsing-data-collectorhttps://runtimerebel.com/blog/modheader-extension-pulled-over-dormant-browsing-data-collectorModHeader, a popular browser extension with 1.6M installs on Chrome and Edge, was pulled by Google and Microsoft after a dormant browsing history collector was found.Mon, 13 Jul 2026 20:58:15 GMTModHeaderBrowser ExtensionChromeEdgeSupply Chain AttackData CollectionMalwarehttps://runtimerebel.com/blog/lidl-data-breach-service-provider-hack-exposes-customer-infohttps://runtimerebel.com/blog/lidl-data-breach-service-provider-hack-exposes-customer-infoLidl notifies customers in Germany, Belgium, and Netherlands after a third-party service provider breach exposed personal data and order histories.Mon, 13 Jul 2026 14:40:17 GMTLidl BreachThird Party RiskSupply Chain AttackRetail SecurityData Exfiltrationhttps://runtimerebel.com/blog/jscrambler-8-14-0-compromised-rust-infostealer-supply-chain-attackhttps://runtimerebel.com/blog/jscrambler-8-14-0-compromised-rust-infostealer-supply-chain-attackThe jscrambler 8.14.0 npm release was compromised with a malicious preinstall hook dropping a cross-platform Rust infostealer. Mitigate the threat now.Sat, 11 Jul 2026 20:50:45 GMTJscramblerNPMSupply Chain AttackRust MalwareInfostealerhttps://runtimerebel.com/blog/injective-labs-npm-package-compromise-steals-crypto-keyshttps://runtimerebel.com/blog/injective-labs-npm-package-compromise-steals-crypto-keysCritical supply chain attack compromises Injective Labs SDK on GitHub, distributing malicious npm package `@injectivelabs/sdk-ts@1.20.21` to steal crypto wallet keys.Fri, 10 Jul 2026 17:48:42 GMTInjective LabsNPMSupply Chain AttackCryptocurrencyWallet TheftMalicious PackageSDKhttps://runtimerebel.com/blog/injective-sdk-npm-compromise-crypto-wallet-stealer-detectedhttps://runtimerebel.com/blog/injective-sdk-npm-compromise-crypto-wallet-stealer-detectedA malicious version of the Injective SDK (injective-js) on npm was published via a GitHub compromise, deploying a crypto wallet stealer. Developers are at risk.Fri, 10 Jul 2026 03:32:02 GMTInjective SDKNPMCryptocurrencyWallet StealerSupply Chain AttackMalwareInjective Jshttps://runtimerebel.com/blog/openmandriva-insider-sabotage-risks-of-contributor-access-misusehttps://runtimerebel.com/blog/openmandriva-insider-sabotage-risks-of-contributor-access-misuseOpenMandriva Linux reports an attempted internal sabotage by a disgruntled contributor, highlighting critical risks of insider threats in open-source projects.Fri, 10 Jul 2026 03:31:37 GMTOpenMandrivaInsider ThreatOpen Source SecuritySupply Chain Attackhttps://runtimerebel.com/blog/npm-12-enhances-supply-chain-security-by-disabling-install-scriptshttps://runtimerebel.com/blog/npm-12-enhances-supply-chain-security-by-disabling-install-scriptsnpm version 12 introduces critical security defaults, disabling install scripts and deprecating GATs, significantly mitigating JavaScript supply chain risks.Thu, 09 Jul 2026 17:57:40 GMTNPMSupply Chain SecurityInstall ScriptsSecurity DefaultsGATs2FAJavaScript Packageshttps://runtimerebel.com/blog/fake-paysafe-skrill-sdks-on-npm-pypi-steal-credentialshttps://runtimerebel.com/blog/fake-paysafe-skrill-sdks-on-npm-pypi-steal-credentialsMalicious packages impersonating Paysafe and Skrill SDKs on npm and PyPI platforms are stealing credentials from developers and users. Threat intelligence analysis.Wed, 08 Jul 2026 21:35:17 GMTNPMPyPISupply Chain AttackCredential TheftPaysafeSkrillNetellerMalwarehttps://runtimerebel.com/blog/github-actions-attack-patterns-evade-ci-security-scannershttps://runtimerebel.com/blog/github-actions-attack-patterns-evade-ci-security-scannersLearn how sophisticated GitHub Actions attack patterns bypass traditional CI security scanners, exposing CI/CD pipelines to supply chain risks. Understand the threats…Tue, 07 Jul 2026 14:38:51 GMTGitHub ActionsCI CD SecuritySupply Chain SecuritySecurity ScanningCode Integrityhttps://runtimerebel.com/blog/polinrider-north-korean-hackers-push-108-malicious-packageshttps://runtimerebel.com/blog/polinrider-north-korean-hackers-push-108-malicious-packagesAnalysis of the PolinRider campaign where North Korean actors published 108 malicious packages and extensions across npm, Go, and Chrome ecosystems.Sat, 04 Jul 2026 13:37:02 GMTPolinRiderLazarus GroupNPMChrome Web StoreSupply Chain AttackNorth Koreahttps://runtimerebel.com/blog/n-korea-linked-npm-packages-mimic-rollup-polyfills-for-data-thefthttps://runtimerebel.com/blog/n-korea-linked-npm-packages-mimic-rollup-polyfills-for-data-theftNorth Korea-linked actors use malicious npm packages ('rollup-packages-polyfill-core', 'rollup-runtime-polyfill-core') to steal developer secrets, mimicking Rollup…Fri, 03 Jul 2026 17:27:44 GMTNPMRollupSupply Chain AttackNorth Korea LinkedDeveloper SecretsMalicious Packageshttps://runtimerebel.com/blog/auditing-ai-driven-software-development-security-governance-strategieshttps://runtimerebel.com/blog/auditing-ai-driven-software-development-security-governance-strategiesLearn how to audit AI-generated code and govern AI tool usage to mitigate security risks in modern software development lifecycles.Fri, 03 Jul 2026 07:29:45 GMTAI SecuritySoftware Development LifecycleGovernanceLLM Securityhttps://runtimerebel.com/blog/windows-11-emoji-panel-gif-fix-highlights-supply-chain-dependencyhttps://runtimerebel.com/blog/windows-11-emoji-panel-gif-fix-highlights-supply-chain-dependencyMicrosoft resolves Windows 11 Emoji Panel GIF functionality after provider shutdown, underscoring third-party service dependencies in OS features.Wed, 01 Jul 2026 13:05:33 GMTWindows 11Emoji PanelGIFMicrosoftService DisruptionSupply Chain Dependencyhttps://runtimerebel.com/blog/education-sector-third-party-risk-protecting-student-datahttps://runtimerebel.com/blog/education-sector-third-party-risk-protecting-student-dataThe education sector confronts growing third-party breach threats, endangering student data. This article details vendor risk mitigation strategies against ransomware…Sat, 27 Jun 2026 16:29:33 GMTEducation SectorThird Party RiskVendor Risk ManagementStudent Data ProtectionRansomwareData Breachhttps://runtimerebel.com/blog/linux-foundation-s-project-akrites-bolstering-open-source-securityhttps://runtimerebel.com/blog/linux-foundation-s-project-akrites-bolstering-open-source-securityProject Akrites aims to streamline vulnerability management across open source projects, enhancing reporting, patching, and disclosure processes for critical software.Fri, 26 Jun 2026 12:52:09 GMTLinux FoundationAkritesOpen Source SecurityVulnerability ManagementSoftware Supply Chainhttps://runtimerebel.com/blog/cordyceps-ci-cd-flaws-supply-chain-attacks-on-github-repositorieshttps://runtimerebel.com/blog/cordyceps-ci-cd-flaws-supply-chain-attacks-on-github-repositoriesNovee Security uncovered Cordyceps, a critical CI/CD workflow flaw exposing over 300 GitHub repositories to supply chain compromise, affecting major organizations.Wed, 24 Jun 2026 16:50:14 GMTCordycepsCI CDGitHubSupply Chain AttackNovee SecurityRepository Compromisehttps://runtimerebel.com/blog/cordyceps-defending-against-malicious-pull-requests-in-ci-cdhttps://runtimerebel.com/blog/cordyceps-defending-against-malicious-pull-requests-in-ci-cdThe Cordyceps campaign highlights critical CI/CD vulnerabilities in GitHub Actions, targeting high-profile projects like Apache Doris and Cloudflare Workers SDK.Wed, 24 Jun 2026 09:23:01 GMTGitHub ActionsCI CD SecuritySupply Chain AttackDevSecOpsCordycepshttps://runtimerebel.com/blog/oauth-token-theft-how-icarus-targets-salesforce-via-klue-breachhttps://runtimerebel.com/blog/oauth-token-theft-how-icarus-targets-salesforce-via-klue-breachAttackers known as Icarus are exploiting compromised OAuth tokens from Klue to exfiltrate sensitive Salesforce data. Learn how to mitigate supply chain risks.Wed, 24 Jun 2026 09:21:31 GMTSalesforceKlueIcarusOAuth Token TheftSupply Chain Attackhttps://runtimerebel.com/blog/malicious-npm-packages-impersonate-postcss-to-deliver-windows-rathttps://runtimerebel.com/blog/malicious-npm-packages-impersonate-postcss-to-deliver-windows-ratSecurity researchers uncover malicious npm packages such as postcss-minify-selector-parser delivering Windows RATs via supply chain attacks. Audit your builds.Tue, 23 Jun 2026 13:10:31 GMTNPMPostCSSTyposquattingRATJavaScripthttps://runtimerebel.com/blog/shapedplugin-supply-chain-attack-wordpress-pro-plugins-backdooredhttps://runtimerebel.com/blog/shapedplugin-supply-chain-attack-wordpress-pro-plugins-backdooredAttackers compromised ShapedPlugin's distribution pipeline to inject backdoors into Pro WordPress plugins. Learn how to detect and remediate this supply chain threat.Tue, 23 Jun 2026 00:57:15 GMTShapedPluginWordPressSupply Chain AttackBackdoorWordfencehttps://runtimerebel.com/blog/north-korean-sapphire-sleet-compromises-140-mastra-ai-npm-packageshttps://runtimerebel.com/blog/north-korean-sapphire-sleet-compromises-140-mastra-ai-npm-packagesMicrosoft attributes the Mastra AI supply chain attack to Sapphire Sleet (BlueNoroff), involving 140+ malicious npm packages targeting AI developers.Sat, 20 Jun 2026 16:38:13 GMTSapphire SleetBlueNoroffMastra AINPMSupply Chain AttackLazarus Grouphttps://runtimerebel.com/blog/klue-security-incident-mitigating-third-party-risk-in-intelligencehttps://runtimerebel.com/blog/klue-security-incident-mitigating-third-party-risk-in-intelligenceAnalyze the impact of the Klue security incident on Recorded Future. Learn how to secure SaaS integrations and improve third-party vendor risk management.Fri, 19 Jun 2026 09:54:33 GMTKlueRecorded FutureSupply Chain AttackThird Party RiskData Breachhttps://runtimerebel.com/blog/novo-nordisk-breach-securing-secrets-in-github-development-pipelineshttps://runtimerebel.com/blog/novo-nordisk-breach-securing-secrets-in-github-development-pipelinesAnalysis of the Novo Nordisk GitHub token leak and why secrets management must transition from static tools to identity-based security frameworks.Fri, 19 Jun 2026 09:48:31 GMTGitHubSecrets ManagementNovo NordiskDevSecOpsCI CD Securityhttps://runtimerebel.com/blog/klue-supply-chain-attack-hits-salesforce-instances-of-security-firmshttps://runtimerebel.com/blog/klue-supply-chain-attack-hits-salesforce-instances-of-security-firmsAttackers breached competitive intelligence platform Klue, exfiltrating data from Salesforce instances of customers including Huntress and Recorded Future.Fri, 19 Jun 2026 09:44:49 GMTKlueSalesforceHuntressRecorded FutureSaaS SecurityData Exfiltration