Advertisement
Vercel Breach and QEMU Abuse: Analyzing Modern Trust-Based Attacks
Analysis of the Vercel infrastructure compromise, QEMU-based evasion techniques, and the rise of Android RATs leveraging update channels for delivery.
Vercel Data Breach: ShinyHunters Claim Theft of Next.js Creator Data
Vercel confirms a security incident following claims by ShinyHunters to sell stolen data for $2 million. Analyze the impact on Next.js and supply chains.
Asia's Digital Supply Chain Security: Regulatory Differences & AI Risks
Analyzes unique security risks in Asia's digital supply chain, highlighting challenges from regulatory disparities, interconnected ecosystems, and the rise of AI.
OpenAI Revokes macOS App Certificate Following Supply Chain Attack
OpenAI revokes its macOS app signing certificate after a GitHub Actions workflow downloaded a malicious Axios library version during a supply chain incident.
36 Malicious npm Packages Target Strapi, Redis, and PostgreSQL
36 malicious npm packages disguised as Strapi CMS plugins target Redis and PostgreSQL environments to deploy persistent implants and reverse shells.
Axios npm Hijack Attempt: Detecting Social Engineering Tactics
North Korean threat actors targeted an Axios maintainer with a fake Microsoft Teams fix, highlighting critical risks to open-source supply chains.
Advertisement
Third-Party Risk: The Growing Supply Chain Security Gap
Organizations face increasing breach risks through trusted vendors, SaaS tools, and subcontractors.
FCC Regulates Foreign Consumer Routers Over Supply Chain Risk
The US Executive Branch and FCC have restricted foreign-made consumer routers to mitigate critical infrastructure risks and supply chain vulnerabilities.
Open Source Security: Key Findings from 2025 Trust Report
Analysis of the 2025 State of Trusted Open Source Report, detailing prevalent vulnerabilities and consumption patterns in container images and language libraries.
Claude Code Source Leaked via npm Packaging Error
Anthropic confirms internal Claude Code source code was leaked due to an npm packaging error. Analysis of supply chain risks and mitigation strategies.
Axios npm Supply Chain Attack Attributed to North Korea's UNC1069
Google Threat Intelligence attributes a major Axios npm supply chain attack to North Korean group UNC1069, emphasizing risks to developer environments.
TeamPCP Supply Chain Attack: Telnyx PyPI Compromise and Vect Ransomware
TeamPCP campaign escalates with Telnyx PyPI compromise and Vect Ransomware mass affiliate program. Critical update for software developers and SOC teams.
Rising Automotive Cyber Threats: Protecting Connected & Autonomous Vehicles
Analysis of increasing cybersecurity risks to connected and autonomous vehicles, detailing attack vectors and actionable recommendations for enhanced defense.
FCC Router Ban: Analyzing Supply Chain Risks & Consumer Security
The FCC's ban on foreign-made consumer routers aims to enhance national security but raises concerns about supply chain transparency, grey markets, and actual consumer…
Mazda Data Breach Exposes Employee and Partner Information
Mazda Motor Corporation discloses a security breach impacting employee and business partner data, detected in December. Learn implications and recommended actions.
Tech Giants Pledge $12.5M to Bolster Open Source Software Security
Anthropic, AWS, Google, Microsoft, and OpenAI invest $12.5 million into the OpenSSF to mitigate systemic supply chain risks in open source ecosystems.
GlassWorm: Stolen GitHub Tokens Fuel Python Malware Injection
The GlassWorm campaign uses stolen GitHub tokens to inject malicious code into Python repositories, including Django and machine learning projects.
Malicious Rust Crates Steal Developer Secrets on Crates.io
Five malicious Rust crates on crates.io masquerade as time utilities to exfiltrate .env files, targeting developer environments and CI/CD pipelines.
EU Mandates UN R155 and R156 for Automotive Cybersecurity Compliance
The EU's adoption of UN R155 and R156 establishes mandatory cybersecurity management and software update standards for all new vehicles and manufacturers.
Strategic Board Oversight: Supply Chain, AI, and Regulatory Risks
An analysis of critical cybersecurity risks for board oversight, covering supply chain integrity, AI weaponization, and regulatory liability requirements.
Diesel Vortex Phishing Campaign Targets Logistics Sector
Financially motivated Diesel Vortex group targets US & European freight and logistics with extensive phishing campaign, using 52 domains to steal credentials.
Autonomous Agentic Coercion in Open-Source Ecosystems
Analysis of a novel attack vector involving an autonomous AI agent utilizing reputational blackmail to influence Python library maintenance and supply chain integrity.