The newest Supply Chain Security resources are on the Supply Chain Security page. For a reading order instead of a date order, see the Supply Chain Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-10 2026 | N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust news 3 min read | Library detailing the Contagious Interview campaign, which has released over 1,700 malicious packages across npm, PyPI, Go, Rust, and Packagist. These packages, including `dev-log-core`, `logutilkit`, and `github[.]com/golangorg/formstash`, function as malware loaders, distributing infostealers and RATs capable of post-compromise activity. The malicious code is concealed within legitimate functions, making detection challenging. → thehackernews.com |
| 2026-04-10 2026 | The Next Wave of Supply Chain Attacks: NPM, PyPI, and Docker Hub news 7 min read | Survey connecting supply chain attacks across npm, PyPI, and Docker Hub, highlighting root causes like maintainer phishing and weak authentication, as seen in incidents involving npm packages like chalk and debug, PyPI packages like num2words, and official Debian base images on Docker Hub. It emphasizes the danger of malicious content persistence and reactive detection, pointing out how stolen credentials and exploitable registry gaps allow attackers to poison ecosystems. |
| 2026-04-10 2026 | PyPI, npm, and the New Frontline of Software Supply Chain Attacks news 5 min read | Library for analyzing software supply chain attacks, detailing incidents involving Trivy (CVE-2026-33634), LiteLLM, Telnyx, and Axios. These attacks targeted popular open-source packages and developer tooling, with attackers gaining unauthorized access to trusted projects and injecting malicious code. The primary objective was credential theft, including cloud keys and SSH keys, with some incidents also exfiltrating cryptocurrency wallet files. The library highlights the need for dependency hygiene and strong CI/CD security controls, such as pinning package versions, atomic credential rotation, and restricting egress from CI/CD runners. |
| 2026-04-10 2026 | Malicious PyPI and npm Packages Exploiting Dependencies in Supply Chain Attacks news 3 min read | Library detailing malicious PyPI and npm packages exploiting supply chain vulnerabilities. The `termncolor` PyPI package, leveraging the `colorinal` dependency, employed DLL side-loading via `vcpktsvr.exe` and `libcef.dll` for persistence and command-and-control communication. Similarly, compromised npm packages like `redux-ace` and `rtk-logger` targeted developers via job assessments, harvesting credentials and system data. These incidents highlight risks from automated dependency upgrades, exemplified by the `eslint-config-prettier` compromise. → thehackernews.com |
| 2026-04-10 2026 | Supply Chain Attack: How Attackers Weaponize Software beginner 25 min read | Library detailing software supply chain attacks, explaining how attackers weaponize trust in open source packages from registries like npm and PyPI, CI/CD platforms such as GitHub Actions, and cloud SDKs from vendors like AWS. It covers how compromised developer accounts, malicious updates, or abused CI/CD credentials can lead to vulnerabilities, citing the CCleaner incident as an example of malicious code injected into a digitally signed release. |
| 2026-04-10 2026 | 2026 Supply Chain Security Report: Attack Analysis news 9 min read | Report analyzing the 2025-2026 supply chain attack landscape, including the multi-wave Shai-Hulud campaigns, the s1ngularity attack on Nx, GhostActions on PyPI, and the September npm hijacking. It details common attack patterns like credential compromise, install-time execution, cross-ecosystem propagation, and CI/CD pipeline exploitation, noting incidents at Jaguar Land Rover and Marks & Spencer, alongside F5 BIG-IP source code theft. The report also maps supply chain security requirements to SOC 2 and ISO 27001 compliance frameworks. |
| 2026-04-10 2026 | Securing Software Supply Chains: 2026 Priorities beginner 5 min read | Survey of 2026 software supply chain security priorities, this event discussed critical infrastructure needs driven by AI-generated code and open-source components. Key themes included visibility gaps in AI and open-source, challenges aligning compliance with operations, and the necessity for better coordination across security, policy, and procurement teams. It also highlighted the importance of organizational resilience through role clarity, consistent third-party oversight, context-guided modernization, stronger compliance execution, improved metrics, and enhanced collaboration across sectors to address evolving threats. |
| 2026-04-10 2026 | 2026 Software Supply Chain Report news 13 min read | Report detailing the 2025 evolution of open source malware, with over 454,600 new malicious packages identified across major registries like npm and PyPI. The report highlights industrialized campaigns by state-linked entities such as the Lazarus Group, who deployed sophisticated multi-stage payload chains and introduced self-replicating malware like Shai-Hulud. Attacks increasingly leverage typosquatting, namespace confusion, and toolchain masquerading to target developer and build environments, with observed behaviors including TEA token harvesting, secrets exfiltration, and backdoor deployment. → sonatype.com |
| 2026-04-10 2026 | Supply Chain Attacks 2025-2026: Axios, Shai-Hulud, and More news 11 min read | Analysis of supply chain attacks from 2025-2026 details incidents like the Axios npm RAT, Shai-Hulud worm, Chalk/Debug compromise, Nx/s1ngularity attack, and the TeamPCP campaign. These attacks exploited compromised npm accounts, typosquatting, build pipeline infiltration, and dependency confusion across npm, PyPI, GitHub Actions, and container registries. The analysis explains common attack vectors, impact including credential exfiltration and crypto wallet draining, and outlines detection and automated remediation strategies for security teams. |
| 2026-04-09 2026 | Inside the TeamPCP cascading supply chain attack news 9 min read | Library for detecting and mitigating supply chain attacks, detailing the TeamPCP campaign that compromised the telnyx and LiteLLM PyPI packages, as well as Checkmarx extensions on Open VSX. The attacks leveraged stolen credentials to inject malicious code, exfiltrating cloud secrets and tokens, impacting security tools like Trivy and KICS GitHub Actions, and demonstrating the risks of unverified dependencies. → reversinglabs.com |
| 2026-04-09 2026 | Hackers Expose Vulnerabilities in Software Supply Chains news 4 min read | Library for detecting and mitigating software supply chain risks, exemplified by the Axios NPM package compromise attributed to North Korea-nexus threat actor UNC1069. This incident highlights how attackers exploit trust relationships in development workflows, injecting malicious code like WAVESHAPER.V2 via compromised maintainer accounts. The attack vector, involving a JavaScript dropper with obfuscation, demonstrates the cascading impact of transitive dependencies across development ecosystems, leading to potential credential theft, system compromises, and extortion. |
| 2026-04-09 2026 | LiteLLM PyPI Supply Chain Attack Reaches Mercor: Two Poisoned Releases AI Gateway Credential Risk and the Fallout That Froze Work news 7 min read | Library detailing a LiteLLM PyPI supply chain attack, specifically versions 1.82.7 and 1.82.8, which compromised AI gateway credentials. The incident highlights the risks of poisoned releases and the propagation of credential exposure through automated build systems and startup mechanism abuse. Remediation involves dependency verification, secret rotation, and auditing egress traffic, emphasizing the critical need for secure pipelines and hash validation protocols for third-party code. |
| 2026-04-09 2026 | Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer news 6 min read Python | Library for Python that, when compromised in versions 1.82.7 and 1.82.8, acted as a multi-stage credential stealer. The malicious code within the popular litellm package could exfiltrate sensitive data including API keys, environment variables, cloud credentials (AWS, GCP, Azure), and Kubernetes secrets. It deployed a three-layer payload for reconnaissance, data harvesting, and establishing persistence, potentially linked to TeamPCP and LAPSUS$. → sonatype.com |
| 2026-04-08 2026 | Axios Compromised: The Supply Chain Attack Shows How Thin the Line Between Everyday Packages and Malicious Code Has Become news 3 min read | Analysis of the Axios supply chain attack, where malicious dependency plain-crypto-js was injected into Axios versions 1.14.1 and 0.30.4 on March 31, 2026. Google Threat Intelligence and Microsoft confirmed the incident, linking it to UNC1069 and WAVESHAPER.V2 malware, with affected platforms including Windows, macOS, and Linux. The attack leveraged trust in everyday packages, potentially leading to RAT payload downloads and credential exfiltration in CI systems and build pipelines, highlighting the vulnerability of software supply chains. |
| 2026-04-08 2026 | Why the Next Supply Chain Shock Will Come From Cyber Not Shortages news 4 min read | Analysis of third-party cyber risk highlights how compromised suppliers like Collins Aerospace and the retailer Mango cause widespread disruption. Current reliance on static assessments is insufficient; a shift to continuous assurance is necessary. This involves embedding security into partnership agreements, ongoing verification through audits and monitoring, and aligning with frameworks like NIST 800-53 and ISO 27001 to manage the digital supply chain proactively. |
| 2026-04-07 2026 | Guardarian Users Targeted With Malicious Strapi NPM Packages news 2 min read | Library of 36 malicious NPM packages targeting Strapi users, discovered by SafeDep, delivered payloads for Redis code execution, Docker container escape, credential harvesting, and reverse shell deployment. Payloads exploited Redis instances for webshells and reverse shells, escaped Docker containers, and targeted PostgreSQL databases. The campaign specifically aimed at Guardarian users, exfiltrating configurations and API modules, with attackers pivoting to reconnaissance and data collection after initial aggressive approaches failed. → securityweek.com |
| 2026-04-07 2026 | Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack news 12 min read | Analysis of the largest npm supply chain attack detailing StepSecurity's real-time detection of a compromised axios package. The incident involved a state-sponsored actor hijacking the popular HTTP client, inserting a malicious dependency, and actively deleting GitHub issues to conceal the compromise. StepSecurity utilized its AI Package Analyst and Harden-Runner to identify suspicious indicators and anomalous network activity, enabling rapid notification and remediation efforts for customers. → stepsecurity.io |
| 2026-04-07 2026 | Malicious Axios npm Packages Trigger Supply Chain Attack: How Attackers Could Access Crypto Wallets and API Keys news | Malicious Axios npm Packages Trigger Supply Chain Attack: How Attackers Could Access Crypto Wallets and API Keys https://ift.tt/y4GF6z0 |
| 2026-04-07 2026 | North Korean Hackers Target High-Profile Node.js Maintainers news 2 min read | Analysis of UNC1069's social engineering campaign targeting Node.js maintainers, including those involved with Socket, Platformatic, Dotenv, and the Node.js Security Working Group. These attackers employ detailed, multi-week lures, mirroring tactics seen in Operation Dream Job and Contagious Interview, to trick high-profile maintainers into executing malware, as evidenced by the Axios supply chain attack. → securityweek.com |
| 2026-04-07 2026 | Avocado warns on code repository supply chain attacks news | Avocado warns on code repository supply chain attacks https://ift.tt/I76zWlE |
| 2026-04-06 2026 | AI-Assisted Supply Chain Attack Targets GitHub news | AI-Assisted Supply Chain Attack Targets GitHub https://ift.tt/W3OMdbX → darkreading.com |
| 2026-04-06 2026 | How to Prevent OWASP Software Supply Chain Failures intermediate 17 min read | Reference for preventing OWASP A03:2025 Software Supply Chain Failures, emphasizing continuous third-party monitoring, SBOM management, and device fingerprinting. This category, ranked number one in community surveys, encompasses compromises in building, distributing, or updating software, often through third-party code or tools. Effective strategies involve preventive controls like SBOM and dependency governance, alongside detective controls that monitor for abnormal behavior, addressing risks such as using obsolete functions and unmaintained components, and validating software integrity and provenance. |
| 2026-04-06 2026 | Axios Compromise on npm Introduces Hidden Malicious Package news 5 min read | Writeup on the axios npm compromise, where attackers hijacked an account to publish malicious versions (axios@1.14.1, axios@0.30.4) that silently introduced a hidden dependency on `plain-crypto-js@4.2.1`. This technique, tracked as sonatype-2026-001623 and sonatype-2026-001622 respectively, leveraged npm's postinstall scripts to execute obfuscated code, download a RAT, and spread to other packages like those in the OpenClaw ecosystem. → sonatype.com |
| 2026-04-06 2026 | NPM Supply Chain Attacks Explained: Dependency Confusion Exploits and Defense intermediate 10 min read | Library detailing NPM supply chain attacks, focusing on dependency confusion exploits and defense strategies. It analyzes significant incidents like the 2025 NPM Phishing Hack compromising chalk and debug, the Shai-Hulud malware worm targeting credentials and proliferating through postinstall scripts, and the 2026 SANDWORM_MODE exploit poisoning AI toolchains via typosquatting. The library also covers critical NPM vulnerabilities such as install-time arbitrary code execution and extreme dependency depth, and outlines bug bounty methodologies for hunting dependency confusion. |
| 2026-04-06 2026 | Axios npm Package Compromised in Supply Chain Attack news 2 min read | Library compromised in a supply chain attack affecting axios@1.14.1 and axios@0.30.4 via the malicious plain-crypto-js@4.2.1 package. The attack, originating from a hijacked maintainer account, poisoned both the 1.x and 0.x branches of the popular npm HTTP client. Mitigation strategies include rolling back to unaffected versions, pinning dependencies, or using alternative HTTP clients like the native fetch API, got, or ky. → infoq.com |
| 2026-04-06 2026 | The 2026 Guide to Software Supply Chain Security beginner | The 2026 Guide to Software Supply Chain Security |
| 2026-04-05 2026 | Week in review: Axios npm supply chain compromise critical FortiClient EMS bugs exploited news 9 min read | Library of security news and analysis detailing recent exploits including the Axios npm supply chain compromise, FortiClient EMS vulnerabilities (CVE-2026-35616, CVE-2026-21643), Cisco IMC auth bypass (CVE-2026-20093), and a Google Chrome zero-day (CVE-2026-5281). It also covers the emergence of EvilTokens for Microsoft 365 phishing, malware distribution via Claude Code leaks, and TrueConf zero-day exploitation targeting government networks. → helpnetsecurity.com |
| 2026-04-05 2026 | 36 Malicious npm Packages Exploited Redis PostgreSQL to Deploy Persistent Implants news 6 min read | Library of 36 malicious npm packages disguised as Strapi CMS plugins, which exploit Redis and PostgreSQL to deploy persistent implants, harvest credentials, and execute reverse shells. These packages, uploaded under fake developer accounts, utilize the `postinstall.js` script to execute payloads including Docker container escape, system reconnaissance, and PostgreSQL database exploitation with hardcoded credentials. The campaign's evolution shows a pivot from aggressive exploitation to data collection and targeted credential theft, potentially indicating a cryptocurrency platform attack. → thehackernews.com |
| 2026-04-04 2026 | How critical Axios NPM package got hacked: maintainer shared full story intermediate | How critical Axios NPM package got hacked: maintainer shared full story https://ift.tt/cqQuNFB → cybernews.com |
| 2026-04-04 2026 | UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack intermediate 5 min read | Writeup detailing UNC1069's sophisticated social engineering campaign that compromised the Axios npm package. Threat actors, identified as North Korean, meticulously cloned company founders and branding to build rapport, then used fake Slack workspaces and Microsoft Teams calls to trick maintainers into downloading remote access trojans. This allowed them to steal npm credentials and publish trojanized versions (1.14.1 and 0.30.4) containing the WAVESHAPER.V2 implant, demonstrating a scalable pattern targeting high-impact open-source maintainers to poison the software supply chain. → thehackernews.com |
| 2026-04-04 2026 | European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack news 2 min read | Writeup detailing the European Commission's data breach, confirming over 300GB of data theft from its AWS environment. Hackers exploited an API key compromised during the TeamPCP-led supply chain attack on Aqua Security's Trivy vulnerability scanner. The attackers leveraged tools like TruffleHog to discover secrets and exfiltrate data related to 71 clients of the Europa web hosting service, with the stolen information later appearing on the ShinyHunters leak site. → securityweek.com |
| 2026-04-04 2026 | Mercor faces class action lawsuit after supply chain attack news 3 min read | Lawsuit against Mercor alleges failure to implement basic cybersecurity protections, including multifactor authentication and data encryption, leading to a supply chain attack via the LiteLLM open-source software tool. The breach, attributed to the Lapsus$ group, reportedly exposed over 40,000 individuals' sensitive personal data. The suit seeks damages for identity theft, fraud, and invasion of privacy, demanding significant overhauls to Mercor's data security systems and program. |
| 2026-04-03 2026 | Do not get high(jacked) off your own supply (chain) news 3 min read | Analysis of recent supply chain attacks targeting widely used libraries like Axios and projects like Trivy, highlighting the impact of vulnerabilities such as React2Shell and Log4j. The entry emphasizes the ongoing threat posed by compromised open-source components and the necessity of securing CI/CD pipelines, maintaining software inventories, and implementing fundamental security practices like MFA and robust logging. → blog.talosintelligence.com |
| 2026-04-03 2026 | 12 Months That Changed Supply Chain Security - 2025 Month by Month news 10 min read | Survey of 2025 supply chain threats, month by month, detailing targeted developer compromises, CI/CD manipulation, and open-source module poisoning. Notable incidents include Lazarus Group's Operation 99 and Operation Marstech Mayhem, PlushDaemon's attack on IPany, UAC-0212 exploiting CVE-2024-38213, the compromise of GitHub Action tj-actions/changed-files via CVE-2025-30066, Scattered Spider's DragonForce ransomware attacks, and the theft of Solana keys via PyPI packages. The analysis highlights the escalating scale and sophistication of attacks across ecosystems, cloud platforms, and critical infrastructure. |
| 2026-04-03 2026 | Securing the Software Supply Chain: OpenSSF, SLSA, SBOM, and Sigstore intermediate | Securing the Software Supply Chain: OpenSSF, SLSA, SBOM, and Sigstore |
| 2026-04-03 2026 | OWASP Top 10 2025: A03 Software Supply Chain Failures (Beginner's Guide) beginner 5 min read | Guide to OWASP Top 10 2025: A03 Software Supply Chain Failures, this entry details common attack vectors such as malicious packages, compromised CI/CD systems, and vulnerable components, citing real-world examples like SolarWinds, Log4j (CVE-2021-44228), and the XZ Utils backdoor (CVE-2024-3094). It offers practical countermeasures including SBOM generation, continuous dependency scanning, artifact signing, and CI/CD hardening, aligning with community concerns over this critical risk. |
| 2026-04-03 2026 | SLSA Framework: The Definitive Guide for Securing Your Software Supply Chain intermediate 9 min read | Library detailing the SLSA (Supply-chain Levels for Software Artifacts) framework, designed to secure the software supply chain against attacks like SolarWinds and Log4Shell. It defines incremental security levels for build processes, focusing on verifiable provenance metadata and automated enforcement. The library explains SLSA's core concepts, including provenance structure, cryptographic signing with Sigstore (Cosign, Fulcio, Rekor), and its alignment with NIST SSDF and EO 14028. It breaks down SLSA's benefits for AppSec engineers and security professionals looking to prevent tampering, ensure artifact integrity, and secure build infrastructure. |
| 2026-04-03 2026 | Five Key Flaws Exploited in 2025's Software Supply Chain Incidents news 7 min read | Analysis of five major 2025 software supply chain incidents, detailing exploitation campaigns targeting critical vulnerabilities. These include the React2Shell RCE flaw (CVE-2025-55182) in React.js, exploited by nation-state groups; the Shai Hulud 2.0 worm that poisoned thousands of npm packages; and the Clop group's exploitation of a zero-day RCE vulnerability (CVE-2025-61882) in Oracle E-Business Suite. The analysis highlights the impact of these exploits on numerous organizations and the increasing sophistication of supply chain attacks. → infosecurity-magazine.com |
| 2026-04-03 2026 | Predictions for Open Source Security in 2025 | OpenSSF news 10 min read | Survey of open source security predictions for 2025, highlighting increased risks from state actors and AI. The xz Utils backdoor incident illustrates vulnerabilities in widely adopted open source projects, often maintained by few volunteers. Generative AI can accelerate vulnerability discovery and sophisticated social engineering attacks, enabling attackers to scale efforts previously requiring nation-state resources. While AI also offers defensive capabilities, the increased attack surface and potential for malicious code injection necessitates greater investment and vigilance in open source supply chains. |
| 2026-04-03 2026 | Supply Chain Attacks in Q4 2025: From Isolated Incidents to Systemic Failure Modes news 9 min read | Survey of systemic supply chain failure modes observed in Q4 2025, including exploits against developer tooling and distribution channels. Case studies like Shai-Hulud (npm) and GlassWorm (VS Code marketplaces) highlight attackers leveraging implicit trust and identity abuse for widespread compromise, while the F5 BIG-IP breach demonstrates vendor compromise propagating downstream. These incidents illustrate how attacks bypassed traditional defenses by targeting dependencies, identities, and update mechanisms, leading to deep initial access and significant "trust debt" across the software supply chain. |
| 2026-04-03 2026 | Supply Chain Security in CI: SBOMs, SLSA, and Sigstore intermediate 4 min read | Library for enhancing CI/CD supply chain security, enabling practical implementation of SBOMs, SLSA provenance, and artifact signing using tools like Syft, cosign, and Grype. It details how to generate CycloneDX or SPDX SBOMs, capture build provenance with SLSA generators, and sign container images or blobs with Sigstore's keyless or key-based signing. The library aids in creating auditable builds, ensuring release integrity, and automating vulnerability scanning by integrating SBOMs with scanners. |
| 2026-04-03 2026 | SLSA - Supply-chain Levels for Software Artifacts intermediate 2 min read | Framework for establishing and improving software supply chain security. SLSA offers a set of standards and controls designed to prevent tampering and enhance the integrity of software packages and infrastructure. It provides four compliance levels, each building on industry-recognized best practices for source code, builds, and dependencies, to create a common language for assessing software supply chain security and protecting against advanced threats. |
| 2026-04-03 2026 | A03 Software Supply Chain Failures - OWASP Top 10:2025 beginner 6 min read | Reference to OWASP Top 10:2025 A03 Software Supply Chain Failures, this entry details breakdowns in software building, distribution, or updates caused by third-party code, tools, or dependencies. It highlights risks like unpatched components (e.g., CWE-1104, CWE-1395), untracked dependencies, and vulnerable CI/CD pipelines, referencing attacks like SolarWinds, Bybit theft, and the Shai-Hulud npm worm, and vulnerable CVEs such as CVE-2017-5638. Prevention involves robust SBOM management, continuous vulnerability monitoring (CVE, NVD, OSV), securing developer tools, and implementing strict change and hardening processes for repositories and build servers. → owasp.org |
| 2026-04-03 2026 | Mercor Breach Linked to LiteLLM Attack Raises AI Supply Chain Security Concerns news 3 min read | Library compromise of LiteLLM, a Python Package Index tool, led to the Mercor breach via a supply chain attack. Attackers injected malicious code, exploiting stolen credentials to upload harmful versions of the library, which automated pipelines then downloaded. This incident exposed sensitive data, including user information, credentials, and proprietary assets, impacting numerous companies and raising significant concerns about AI supply chain security, open-source vulnerabilities, and the tactics of groups like TeamPCP and Lapsus$. |
| 2026-04-03 2026 | North Korean hackers implicated in major supply chain attack news | North Korean hackers implicated in major supply chain attack https://ift.tt/qYWBvLI |
| 2026-04-03 2026 | Source Code Leaks Highlight Lack of Supply Chain Oversight news 4 min read | Analysis of recent supply chain attacks, including compromises of Trivy, Axios, and Anthropic's Claude Code, reveals significant vulnerabilities in development pipelines and credential management. These incidents highlight risks from misconfigured GitHub Actions, compromised maintainer accounts, and inadequate content checks during publishing, allowing malicious code and sensitive source code to enter the supply chain. Attacks on AI coding agents also introduce new persistence vectors, impacting entire developer workstations and downstream software. → darkreading.com |
| 2026-04-03 2026 | Open Source Security Tool Trivy Hit by Supply Chain Attack Prompting Urgent Industry Response news 2 min read | Tool Trivy was compromised in a supply chain attack, with malicious release v0.69.4 briefly distributed, exfiltrating sensitive data and executing malicious code. Attackers leveraged compromised credentials and manipulated release processes, impacting downstream systems and related tooling like GitHub Actions. This incident highlights the vulnerability of trusted open source scanners and CI/CD pipelines, prompting calls for artifact integrity verification, credential scoping, and zero-trust principles in software supply chains. → infoq.com |
| 2026-04-03 2026 | Supply chain blast: Top npm package backdoored to drop dirty RAT on dev machines news 3 min read | Library alert detailing a sophisticated npm supply chain attack where a hijacked maintainer account for the popular Axios package (used by 100 million weekly) introduced two backdoored versions: axios@1.14.1 and axios@0.30.4. Attackers bypassed CI/CD pipelines, publishing a malicious dependency, plain-crypto-js@4.2.1, which delivered cross-platform remote-access trojans (RATs) tailored for macOS, Windows, and Linux. This highly organized campaign, attributed to suspected North Korean threat actor UNC1069, highlights the significant risks associated with compromised dependencies and the need for robust application security practices. → theregister.com |
| 2026-04-03 2026 | Axios Compromised With A Malicious Dependency news 6 min read | Library for detecting and mitigating the Axios supply chain attack where versions 0.30.4 and 1.14.1 were compromised via the malicious dependency `plain-crypto-js` version 4.2.1. This attack installs a Remote Access Trojan (RAT) on Windows, macOS, and Linux systems, enabling attackers to gain complete control. Immediate actions include rotating credentials, pinning dependencies, and treating affected machines as fully compromised. The library can help identify affected versions and provide context on the attack's mechanisms across different operating systems. → ox.security |
| 2026-04-03 2026 | Mitigating the Axios npm supply chain compromise intermediate 13 min read | Analysis of a recent Axios npm supply chain compromise reveals North Korean state actor Sapphire Sleet injected malicious dependencies into popular Axios versions 1.14.1 and 0.30.4. These compromised packages, utilizing a fake runtime dependency `plain-crypto-js@4.2.1` with silent install-time code execution, connected to a Sapphire Sleet-controlled C2 server at `hxxp://sfrclak[.]com:8000/6202033` to download platform-specific remote access trojan (RAT) payloads for Windows, macOS, and Linux. The attack highlights the risks of poisoned open-source frameworks, enabling actors to achieve broad downstream impact by compromising widely adopted libraries. → microsoft.com |