appsec.fyi · Sources

govinfosecurity.com

5 curated AppSec resources from govinfosecurity.com across 2 topics on appsec.fyi.

govinfosecurity.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-12.

Supply Chain 4 API Sec 1
Date Added Resource Excerpt
2026-08-12 2026How Postman Embeds Wiz Risk Data Into Dev WorkflowsAPI SecPostman is integrating Wiz's cloud security risk data directly into its API development platform. This allows developers to see security vulnerabilities, compliance issues, and misconfigurations alongside their API code and documentation. The goal is to empower developers to address security concerns earlier in the development lifecycle, fostering a "shift-left" security approach. By embedding this contextual risk information, Postman aims to make security a more inherent part of the development process, rather than an afterthought.
2026-06-17 2026Mastra AI Framework Poisoned in npm Supply-Chain AttackSupply ChainLibrary poisoning targeted the Mastra AI framework, compromising over 140 packages via a malicious dependency named `easy-day-js`, a typosquat of the popular `dayjs` library. This supply-chain attack, attributed to the TeamPCP group, leveraged phantom dependencies and automated install processes to execute obfuscated payloads downloaded from attacker-controlled servers. Users are advised to downgrade to specific previous versions and utilize lockfiles. Microsoft's upcoming npm v12 release will introduce security fixes, disabling automatic script execution from dependencies by default.
2026-05-25 2026Automated 'Megalodon' Campaign Spreads GitHub Repo BackdoorsSupply ChainLibrary of GitHub Actions workflows that spread the 'Megalodon' campaign, targeting over 5,000 repositories. This automated attack injects base64-encoded bash payloads via forged author identities, stealing CI/CD secrets, cloud credentials, and SSH keys. Variants include 'SysDiag' and 'Optimize-Build,' with affected repositories needing commit reverts, secret rotation, and audit log reviews, particularly for OIDC federation.
2026-05-13 2026Mass Supply-Chain Attack Slams npm and PyPi Hits Mistral AISupply ChainLibrary for detecting and defending against supply-chain attacks, exemplified by the Mini Shai-Hulud worm that targeted npm and PyPI packages, including those from Mistral AI and TanStack. This malware family, known for credential stealing and wiper capabilities, spreads autonomously by compromising publish tokens and includes country-aware logic. Defense strategies include implementing code cooldown periods before package integration and enforcing multifactor authentication across developer accounts.
2026-04-24 2026Flurry of Supply-Chain Software Library AttacksSupply ChainLibrary attacks targeting npm and PyPI repositories have surged, compromising open-source projects like LiteLLM, Axios, Xinference, Namastex.ai, Checkmarx KICS, and Bitwarden CLI. Attackers inject data-stealing malware and worms, such as Shai-Hulud, into popular packages, which are then automatically merged into downstream projects via CI/CD pipelines. These compromises aim to steal developer credentials, cloud secrets, and spread laterally to other repositories, highlighting the fragility of software supply chains.