appsec.fyi

Supply Chain Security Resources

Post Share

A curated AppSec resource library covering XSS, SQLi, SSRF, IDOR, RCE, XXE, OSINT, and more.

Supply Chain Security

Software supply chain security addresses threats that target the dependencies, build systems, and distribution channels that modern applications rely on. High-profile incidents like SolarWinds, Log4Shell, and the xz backdoor demonstrated that attackers increasingly target upstream components rather than applications directly. Supply chain attacks include dependency confusion (substituting malicious packages with names matching internal packages), typosquatting in package registries, compromised maintainer accounts, malicious code injected into build pipelines, and trojanized development tools. Defenses include software bills of materials (SBOMs), dependency pinning and lock files, signature verification, provenance attestation (SLSA framework), regular dependency auditing with tools like Dependabot, Snyk, or Socket, and careful evaluation of new dependencies before adoption.

Date Added Link Excerpt
2026-05-12 NEW 2026RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded newsRubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded https://ift.tt/7j63dDB → thehackernews.com
2026-05-12 NEW 2026SailPoint Discloses GitHub Repository Hack newsSailPoint has disclosed a breach of its GitHub repositories. The incident involved unauthorized access to a limited number of SailPoint GitHub repositories. The company has stated that the unauthorized access did not impact its customer data or production environments. SailPoint has implemented enhanced security measures and is cooperating with law enforcement. No specific bounty payout amount was mentioned. → securityweek.com
2026-05-12 NEW 2026Compromised Mistral AI and TanStack packages may have exposed GitHub cloud and CI/CD credentials in 'mini Shai Hulud' malware infection supply-chain campaign spreads across npm and AI developer ecosystems like wildfire newsA supply-chain attack, dubbed "mini Shai Hulud," has infected popular Mistral AI and TanStack packages distributed via npm. This malware may have exposed sensitive GitHub, cloud, and CI/CD credentials. The campaign is rapidly spreading through AI developer ecosystems, posing a significant security risk to compromised users.
2026-05-12 NEW 2026How AICanDetect Lateral Movement in Supply Chain Attacks intermediateThis content likely discusses how Artificial Intelligence (AI) can be employed to identify lateral movement within supply chain attacks. Lateral movement is a critical phase where attackers expand their access within a compromised network. AI's capabilities in analyzing large datasets and detecting anomalous patterns would be key to spotting these advanced persistent threats. The focus is on leveraging AI to enhance security defenses against sophisticated attacks that exploit the interconnectedness of supply chains. → securityboulevard.com
2026-05-12 NEW 2026TanStack Mistral AI UiPath Hit in Fresh Supply Chain Attack newsA recent supply chain attack has impacted several prominent technology companies, including TanStack, Mistral AI, and UiPath. The exact details of the attack and the extent of the compromise are still under investigation. This incident highlights ongoing vulnerabilities in software supply chains, where compromised third-party components can inadvertently infect downstream users and their systems. Further information regarding the attack's vector, affected data, and remediation efforts is expected as investigations proceed. No bug bounty payout amounts were mentioned in the provided content. → securityweek.com
2026-05-12 NEW 2026Hundreds of open source packages hacked: Im just not gonna run npm install anymore newsHundreds of open source packages hacked: “I’m just not gonna run npm install anymore” https://ift.tt/rDlQGUa → cybernews.com
2026-05-12 NEW 2026Checkmarx Jenkins AST Plugin Compromised in KICS Supply Chain Attack newsCheckmarx Jenkins AST Plugin Compromised in KICS Supply Chain Attack https://ift.tt/5VXPZUo → gbhackers.com
2026-05-12 NEW 2026Claude Code MCP Attack Enables Persistent Token Theft intermediateClaude Code MCP Attack Enables Persistent Token Theft https://ift.tt/sk39bhF → esecurityplanet.com
2026-05-11 NEW 2026JDownloader website compromised to distribute malicious installers newsLibrary for detecting supply chain attacks; this entry details a compromise of the JDownloader website where attackers used an unpatched CMS vulnerability to distribute malicious Windows and Linux installers. The Windows payload deployed a Python RAT, while the Linux installer injected code to establish persistence. JDownloader confirmed the breach, advising users to verify digital signatures for "AppWork GmbH" and recommending OS reinstallation for affected individuals. → scworld.com
2026-05-11 NEW 2026AI Is Reshaping Software Supply Chain Risk beginnerAnalysis of AI's impact on software supply chain security highlights expanding attack surfaces due to AI-assisted development, with 84% of developers using AI tools. Traditional security controls like EDR and MDM lack visibility into AI integrations, browser extensions, and package managers. This leads to increased risk from malicious open-source packages, with Aikido Intel identifying up to 100,000 daily. Organizations require real-time visibility and install-time controls for developer tooling, as compromised workstations grant attackers trusted access to repositories and credentials. → esecurityplanet.com
2026-05-11 NEW 2026TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack newsWriteup of TeamPCP's compromise of the Checkmarx Jenkins AST plugin, occurring weeks after their KICS supply chain attack. This incident highlights the exploitation of software supply chain trust and the potential for incomplete remediation, as evidenced by the defaced GitHub repository and malicious updates to the plugin. The ongoing attacks by TeamPCP underscore the persistent threat to developer tools and credentials. → thehackernews.com
2026-05-11 NEW 2026Build Application Firewalls Aim to Stop the Next Supply Chain Attack beginnerLibrary from InvisiRisk, a build application firewall (BAF), enforces policy during the CI/CD build process by inspecting package activity rather than solely scanning code. This approach aims to prevent supply chain attacks, such as those involving the SolarWinds breach or hijacked npm libraries like Axios, by detecting unexpected or malicious actions within the build environment. The BAF, along with InvisiRisk's TruSBOM tool, provides detailed explanations for risky actions and generates accurate SBOMs by directly observing the software build process, offering a robust defense against evolving threats. → securityweek.com
2026-05-11 NEW 2026Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack newsPlugin version 2.0.13-829.vc72453fa_1c16 of the Checkmarx Jenkins AST plugin is the secure version, after a malicious iteration was published to the Jenkins Marketplace. This compromise, attributed to the TeamPCP hacker gang and potentially the Lapsus$ extortion group, stems from a wider supply chain attack impacting Checkmarx's repositories since March, following a Trivy supply chain incident. → securityweek.com
2026-05-11 NEW 2026Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged newsAnalysis of a TeamPCP intrusion targeting a Jenkins plugin, highlighting the evolving landscape of supply chain attacks. This incident underscores the risks associated with untrusted agentic development layers and the growing threat of AI agent skills being exploited for malicious purposes, mirroring concerns around identity-based cyber resilience and the black market for compromised identities. → theregister.com
2026-05-11 NEW 2026Malicious Hugging Face model masquerading as OpenAI release hits 244K downloads newsLibrary of techniques for defending against malicious Hugging Face models masquerading as legitimate OpenAI releases. This incident highlights the emerging threat of AI repositories as a software supply chain attack vector, with one model, Open-OSS/privacy-filter, reaching 244,000 downloads before removal. The attack involved a malicious loader.py script that delivered infostealer malware targeting browser credentials, cryptocurrency wallets, and system information, bypassing traditional security controls and suggesting links to npm typosquatting and PyPI campaigns. → csoonline.com
2026-05-11 NEW 2026Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged newsLibrary that detects and mitigates supply chain attacks targeting CI/CD pipelines, as demonstrated by Checkmarx's response to an intrusion involving a sabotaged Jenkins plugin used by TeamPCP. The article highlights the increasing risks associated with untrusted agentic development layers and the potential for AI agent skills to be exploited for supply chain compromise. → theregister.com
2026-05-11 NEW 2026Responsible for Systems You Cant See: A C-Suite Guide to AI Supply Chain Risk beginnerGuide for C-suites on AI supply chain risk, highlighting attacks on LiteLLM and axios, which exploited trusted open-source workflows. It emphasizes that AI expands and obscures the attack surface, making executives accountable for systems and dependencies they cannot fully see, audit, or control, necessitating a shift to ecosystem security and continuous dependency monitoring rather than assuming trust.
2026-05-10 NEW 2026Supply Chain Attack: Fake OpenAI Repository on Hugging Face Distributes Infostealer Malware Targeting Developers and AI Tools newsLibrary of techniques detailing a supply chain attack involving a fake OpenAI repository on Hugging Face that distributed an infostealer malware. The malware targeted developers by exfiltrating credentials, session tokens, and cryptocurrency wallets from Chromium and Gecko browsers, Discord tokens, and local files. The attack leveraged typosquatting, social engineering, and evasion tactics like disabling SSL verification and checking for VMs, mapping to MITRE ATT&CK techniques such as T1566 (Phishing) and T1555 (Credentials from Password Stores). → rescana.com
2026-05-10 NEW 2026Official JDownloader site served malware to Windows and Linux users between May 6 and May 7 newsWriteup of a supply chain attack on the JDownloader official website, which occurred between May 6 and May 7, 2026. Attackers compromised the site's content management system, altering download links to serve malware instead of legitimate Windows "Alternative Installer" and Linux shell installers. The deployed malware was a Python-based remote access trojan (RAT). Legitimate installers were digitally signed by "AppWork GmbH," while malicious ones were unsigned or signed by suspicious entities like "Zipline LLC" or "The Water Team." The website was taken offline for investigation and remediation, with correct installer links restored. → securityaffairs.com
2026-05-09 NEW 2026Supply-Chain Attacks in an Era of Automation and Implicit Trust intermediateAnalysis of 2026 supply-chain threats, including the Axios compromise and the Trivy campaign, details how attackers exploit trust in automation and developer systems. The Axios incident involved a compromised npm maintainer account leading to RAT distribution via a malicious dependency, impacting numerous production environments. The Trivy attack leveraged credentials to inject malicious artifacts into CI automation, release binaries, and container images, resulting in secret exfiltration. Additionally, the Quest KACE System Management Appliance vulnerability (CVE-2025-32975) demonstrates how unpatched legacy infrastructure becomes a supply-chain risk.
2026-05-08 NEW 2026DAEMON Tools devs confirm breach release malware-free version newsWriteup of DAEMON Tools supply chain attack confirming trojanized installers for version 12.5.1 (free). Hackers used digitally signed installers to backdoor systems, deploying an information stealer and a lightweight backdoor, with QUIC RAT malware observed in at least one instance. Disc Soft Limited released a malware-free version, 12.6, addressing the vulnerability. → bleepingcomputer.com
2026-05-08 NEW 2026Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise intermediateLibrary targeting developers' systems with the Quasar Linux RAT (QLNX) implants, a malware designed for credential harvesting from files like .npmrc, .pypirc, and .aws/credentials. QLNX masquerades as a kernel thread, wipes logs, and uses seven persistence methods including systemd and crontab. It features a PAM inline-hook backdoor and a kernel-level eBPF rootkit component to hide processes, files, and network ports, ultimately facilitating software supply chain attacks by compromising publishing pipelines and cloud infrastructure. → thehackernews.com
2026-05-08 NEW 2026Kaspersky uncovers targeted DAEMON Tools supply chain attack affecting manufacturing government sectors newsWriteup of a targeted DAEMON Tools supply chain attack where trojanized installers, signed with legitimate developer certificates, deployed backdoors to select government, manufacturing, and scientific organizations. The attack, active since April 8, 2026, used a typosquatted domain and involved sophisticated techniques comparable to the 3CX supply chain incident, highlighting the risks of widely trusted software for attackers.
2026-05-07 NEW 2026Supply chain security on alert as M&A targets agent security beginnerLibrary for mitigating supply chain security risks, particularly those amplified by AI. It addresses threats exemplified by the Axios NPM package tampering and trojanized Daemon Tools installers. The library offers solutions and insights relevant to the increasing M&A activity in agent security, such as Cisco's acquisition of Astrix Security and Palo Alto Networks' acquisition of Portkey. It also provides context for OpenAI's GPT-5.5 Cyber and Anthropic's Mythos, noting their capabilities in vulnerability discovery and potential for misuse, alongside Cisco's open-source Model Provenance Kit for AI model verification.
2026-05-07 NEW 2026Vendor Says Daemon Tools Supply Chain Attack Contained newsAnalysis of the Daemon Tools supply chain attack details how threat actors injected trojanized versions of Daemon Tools Lite (specifically version 12.5.1) released between April 8 and May 5 with code to collect information and deploy backdoors. Disc Soft has since contained the incident, removed compromised files, and released a clean version (12.6.0.2445), advising users to uninstall the affected software and scan their systems. → securityweek.com
2026-05-07 NEW 2026Gemini CLI Vulnerability Could Have Led to Code Execution Supply Chain Attack newsVulnerability analysis of Gemini CLI identified a critical flaw (CVSS 10/10) that could enable supply chain attacks. Exploiting indirect prompts in GitHub issues, attackers could bypass tool allowlists in –yolo mode, leading to arbitrary command execution. This allows for the extraction of secrets, gaining write access to repositories, and pushing malicious code to downstream users. The issue, affecting multiple Google repositories and also impacting headless mode via lax trust, was patched in Gemini CLI version 0.39.1. → securityweek.com
2026-05-07 NEW 2026Disc Soft confirms DAEMON Tools Lite supply chain attack exposed thousands of systems worldwide newsDisc Soft has confirmed a supply chain attack targeting DAEMON Tools Lite, a popular disk imaging software. This attack, which exploited a vulnerability in the software's update mechanism, exposed thousands of systems globally. Attackers were able to distribute malware disguised as legitimate software updates. The exact number of affected users and the potential for further exploitation remain under investigation. No bug bounty payout amount was mentioned.
2026-05-06 NEW 2026DAEMON Tools installers compromised in new supply chain attack newsLibrary for analyzing supply chain attacks, this entry details a compromise of DAEMON Tools installers. Attackers trojanized DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe, distributing malicious payloads signed with valid certificates. The implant communicates with env-check.daemontools[.]cc to download and execute further payloads like envchk.exe and cdg.exe, enabling a minimalist backdoor for remote command execution. The attack, active since April 8, 2026, targeted organizations in Russia, Belarus, and Thailand, with QUIC RAT observed against a Russian educational institution. → scworld.com
2026-05-06 NEW 2026Remember DAEMON Tools? It Was Hacked to Serve Windows Malware newsWriteup on the DAEMON Tools supply chain attack, detailing how a hacker compromised versions 12.5.0.2421 through 12.5.0.2434 distributed from daemon-tools.cc. The attack involved injecting backdoors into installers, impacting thousands of users globally across various sectors, including retail, scientific, and government organizations, with evidence pointing to a Chinese-speaking threat actor.
2026-05-06 NEW 2026Invisible Supply Chain Attack Risks and Trusted Access beginnerInvisible supply chain attacks pose significant risks, often exploiting trusted relationships between software components. These attacks can be difficult to detect as they don't necessarily involve direct system compromises but rather subtle manipulations within the development or distribution pipeline. Establishing and maintaining trusted access controls is crucial to mitigate these threats. This involves rigorous verification of software sources, secure coding practices, and robust monitoring throughout the supply chain. The article likely details strategies for identifying and defending against these insidious threats by focusing on the integrity and trustworthiness of every link in the software supply chain.
2026-05-06 NEW 2026Malware Brief: Air gaps breached CPUs hijacked and supplychain chaos newsAnalysis of APT37's Ruby Jumper, FAUX#ELEVATE cryptominer, and CanisterWorm supply-chain malware reveals attackers targeting air-gapped systems via removable media and cloud services, distributing illicit Monero miners through weaponized résumés, and automating propagation across open-source packages and CI/CD pipelines. These threats exploit assumed trust in isolation models, business workflows, and software supply chains, reducing defender reaction time and increasing blast radius.
2026-05-06 NEW 2026Critical DAEMON Tools Supply Chain Attack: Malware-Compromised Windows Installers Threaten Organizations and Home Users (Versions 12.5.0.242112.5.0.2434) newsWriteup detailing a critical supply chain attack on DAEMON Tools Windows installers (versions 12.5.0.2421-12.5.0.2434), which distributed malware via trojanized executables signed with a legitimate AVB Disc Soft certificate. The malware, including an info-gatherer, backdoor, and QUIC RAT, exfiltrates system data and deploys advanced implants to targeted organizations and home users, leveraging MITRE ATT&CK techniques like T1195.002 (Supply Chain Compromise) and T1553.002 (Code Signing). → rescana.com
2026-05-06 NEW 2026Video game supply chain attack Bleeding Llama US gets early LLM access newsThe provided content is a title and a link, with no descriptive text. Therefore, it's impossible to summarize it beyond stating its title: "Video game supply chain attack Bleeding Llama US gets early LLM access". No bug bounty payout amounts are mentioned.
2026-05-06 NEW 2026Attackers compromised Daemon Tools software to deliver backdoors newsAnalysis of a supply chain attack where attackers compromised Daemon Tools, a popular Windows utility, to deliver backdoors. Signed, trojanized installers served from the official website (versions 12.5.0.2421-12.5.0.2434) downloaded a .NET information collector. This collector gathered system details for targeted deployment of payloads like a minimalistic backdoor and QUIC RAT, capable of injecting into legitimate processes. The attack leveraged legitimate digital certificates, making malicious binaries appear trustworthy. → helpnetsecurity.com
2026-05-06 NEW 2026Hackers compromise Daemon Tools in global supply-chain attack researchers say newsLibrary installers for Daemon Tools were compromised in a global supply-chain attack, impacting users in over 100 countries. Attackers embedded backdoors, including Quic RAT, into versions 12.5.0.2421 through 12.5.0.2434 of the free Daemon Tools Lite, observed since early April. The campaign appears targeted, with initial data collectors deployed broadly and more advanced payloads reserved for specific organizations. Disc Soft has addressed the issue, recommending users update to the latest version.
2026-05-06 NEW 2026Daemon Tools Hit by Suspected Chinese Supply Chain Attack Kaspersky Says newsKaspersky reports that Daemon Tools, a popular file management software, has been targeted in a suspected Chinese supply chain attack. The attackers reportedly injected malicious code into the software's update mechanism, allowing them to gain access to user systems. Further details on the scope of the compromise and any specific payout amounts were not provided in this content.
2026-05-06 NEW 2026Sophisticated Quasar Linux RAT Campaign Targets Software Developers in Supply Chain Attacks newsAnalysis of the Quasar Linux RAT (QLNX) campaign targeting software developers via supply chain attacks. This sophisticated Linux-based malware aims to steal credentials, maintain remote access, and facilitate large-scale supply chain compromises. The campaign is linked to trojanized software installers, including compromised Daemon Tools, distributing backdoors globally. Attackers use staged deployment, selectively targeting high-value organizations after initial broad infection, with potential cyberespionage motives. Compromising developer environments grants access to source code, signing keys, and CI/CD pipelines, enabling downstream attacks. → cxodigitalpulse.com
2026-05-06 NEW 2026QLNX Threat Actors Steal Developer Credentials For Supply Chain Attacks newsQLNX threat actors are targeting software developers to steal their credentials. The objective is to gain access to code repositories and potentially inject malicious code into the software supply chain. This allows them to compromise downstream users and organizations that integrate the affected software. The attackers aim to conduct sophisticated supply chain attacks by leveraging compromised developer accounts. → cyberpress.org
2026-05-06 NEW 2026Sophisticated Quasar Linux RAT Targets Software Developers newsAnalysis of Quasar Linux (QLNX), a sophisticated backdoor targeting software developers. QLNX employs a modular architecture with rootkit capabilities, detection evasion, and multiple persistence methods including crontab, desktop entries, init scripts, service files, and shell lines. It focuses on stealing developer credentials for AWS, Kubernetes, Docker Hub, Git, NPM, and PyPI, enabling attackers to compromise publishing pipelines and pivot to cloud environments. The RAT uses a PAM backdoor and an eBPF rootkit to conceal its presence at both userspace and kernel levels, while supporting 58 commands for comprehensive system control and information harvesting. → securityweek.com
2026-05-06 NEW 2026DAEMON TOOLS supply chain attack ongoing since April thousands affected newsLibrary containing information on the DAEMON Tools supply chain attack, which began in April 2026. Attackers compromised legitimate installers and signed binaries with valid certificates, embedding backdoors into components like DTHelper.exe and DiscSoftBusServiceLite.exe. The campaign delivered information-stealing payloads, and in some cases, advanced implants like QUIC RAT, targeting government, manufacturing, scientific research, and retail sectors across over 100 countries. Kaspersky detects malicious activity including suspicious PowerShell downloads and code injection.
2026-05-06 NEW 2026Android Apps Get Public Verification System to Stop Supply Chain Attacks beginnerAndroid is launching a new public verification system to combat supply chain attacks targeting apps. This system will allow developers to publicly attest to the integrity of their app's source code, build environment, and signing keys. By making this information publicly verifiable, Android aims to increase transparency and trust in the app development process, making it harder for malicious actors to inject compromised code into legitimate applications. This initiative seeks to bolster the security of the Android app ecosystem. → thehackernews.com
2026-05-06 NEW 2026Government Scientific Entities Hit via Daemon Tools Supply Chain Attack newsLibrary containing injected code in Daemon Tools versions 12.5.0.2421 through 12.5.0.2434 has been identified as part of a supply chain attack affecting government, scientific, and other organizations. The compromised binaries, including DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe, activate a backdoor that fetches and executes payloads, with targeted deployments of information collectors and the QUIC RAT observed. → securityweek.com
2026-05-06 NEW 2026Kaspersky Links Suspected Chinese Hackers to Backdoor Planted in Daemon Tools Supply Chain Attack newsAnalysis of a Daemon Tools supply chain attack, attributed to a Chinese-speaking threat actor, where malicious backdoors were implanted in official installers via compromised digital certificates. This sophisticated operation, affecting versions 12.5.0.2421 onward since April 8, 2026, leveraged Daemon Tools' elevated permissions to establish deep system persistence and deploy remote-control malware, resulting in thousands of global infection attempts targeting various sectors including government and industrial operations. → cxodigitalpulse.com
2026-05-06 NEW 2026Extremely targeted supply chain attack hits DAEMON Tools newsLibrary for detecting and analyzing supply chain attacks, exemplified by the compromise of DAEMON Tools installers, which included a backdoor and a second-stage QUIC RAT payload. This incident, similar to past attacks on Notepad++ and CCleaner, highlights the targeting of high-value systems by Chinese-speaking threat actors for espionage. The library helps in identifying system data collection, remote server uploads, and targeted second-stage payload deployment.
2026-05-06 NEW 2026North Korean hackers trojanize gaming platform to spy on ethnic Koreans in China newsAnalysis of ScarCruft's supply chain attack targeting ethnic Koreans in China. North Korean threat actors trojanized the sqgame gaming platform, distributing backdoored Windows and Android software. The Windows variant utilized a patched mono.dll to deliver the RokRAT backdoor and BirdCall implant, while Android versions repackaged games with malicious code to exfiltrate data, targeting HWP files specifically. C2 communication leveraged Zoho WorkDrive accounts. → helpnetsecurity.com
2026-05-06 NEW 2026Supply-Chain Attacks in an Era of Automation and Implicit Trust beginnerLibrary detailing software supply-chain attacks in 2026, focusing on how attackers abuse trusted automation and identity. It examines incidents like the Axios compromise and Trivy campaign, where compromised package maintainers and CI/CD automation led to widespread malicious dependencies and credential exfiltration. The resource also highlights the exploitation of legacy management systems, such as Quest KACE using CVE-2025-32975, emphasizing how attackers leverage inherent trust in these tools to gain entry.
2026-05-05 NEW 2026Bootstrap script exposes PyPI to domain takeover attacks news PythonLibrary exposing PyPI packages to domain takeover vulnerabilities, discovered in legacy bootstrap scripts for tools like zc.buildout and older Python packaging utilities. These scripts, when executed, attempt to download and install the `distribute` package from `python-distribute[.]org`, a domain now available for sale. This vulnerability affects numerous popular packages, including `tornado` and `slapos.core`, potentially allowing attackers to compromise systems by controlling the abandoned domain and serving malicious code. → reversinglabs.com
2026-05-05 NEW 2026Progress Software warns of critical MOVEit Automation vulnerability newsAdvisory regarding CVE-2026-4670, a critical authentication bypass vulnerability in Progress Software's MOVEit Automation, enabling unauthenticated remote access. The alert also addresses CVE-2026-5174, a high-severity privilege escalation flaw. Over 1,400 instances are exposed online, with potential impact on government agencies. While no exploitation is reported yet, previous MOVEit vulnerabilities have been widely exploited by groups like Clop. → scworld.com
2026-05-05 NEW 2026Supply-chain attacks take aim at your AI coding agents news AILibrary for defending against AI coding agent supply-chain attacks. This library addresses the threat of malicious packages, like those used by North Korea's Famous Chollima APT in the PromptMink campaign, which leverage LLM Optimization and knowledge injection to trick autonomous coding agents into incorporating compromised dependencies. It also targets "slopsquatting," where agents hallucinate package names, making them vulnerable to similarly named malicious replacements. → csoonline.com
2026-05-05 NEW 2026DAEMON Tools Breach Used to Spread Malware in Supply Chain Attack newsA supply chain attack exploited a breach in DAEMON Tools, a popular disk imaging software. Threat actors injected malware into legitimate DAEMON Tools updates, distributing it to its user base. This allowed them to gain a foothold on compromised systems, potentially for further malicious activities such as stealing sensitive data or launching additional attacks. The exact payout amount is not specified in the provided content. → cyberpress.org

Related Topics

Secrets 134 resources Credential leaks, secret scanning, and key management RCE 517 resources Arbitrary code execution on remote target systems Deserialization 101 resources Insecure deserialization and gadget chain exploits Python 207 resources Security tools, scripting, and secure coding in Python
Compare: SBOM vs SLSA · SCA vs SAST

Frequently Asked Questions

What is a software supply chain attack?
A supply chain attack targets the components, tools, or processes used to build software rather than the application itself. This includes compromising open-source packages, injecting malicious code into build pipelines, hijacking maintainer accounts, or distributing trojanized development tools — allowing attackers to affect thousands of downstream users simultaneously.
What is dependency confusion?
Dependency confusion (also called namespace confusion) exploits how package managers resolve dependencies. An attacker publishes a malicious package to a public registry with the same name as a private internal package. If the build system checks the public registry first or prefers higher version numbers, it installs the attacker's package instead of the legitimate internal one.
How do you defend against supply chain attacks?
Key defenses include maintaining a Software Bill of Materials (SBOM), using lock files and dependency pinning, enabling automated dependency scanning (Dependabot, Snyk, Socket), verifying package signatures and provenance, adopting the SLSA framework for build integrity, using private registries with allow-lists, and regularly auditing your dependency tree for known vulnerabilities.

Weekly AppSec Digest

Get new resources delivered every Monday.