The newest Supply Chain Security resources are on the Supply Chain Security page. For a reading order instead of a date order, see the Supply Chain Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-03 2026 | North Korean hackers bug software used by thousands of US companies in potential crypto heist attempt news 2 min read | Library: Axios, a software package used by thousands of US companies, was compromised in a supply-chain attack attributed to suspected North Korean hackers. This incident allowed unauthorized access to malicious updates, potentially enabling cryptocurrency theft to fund North Korea's nuclear and missile programs. Experts anticipate a lengthy recovery process and downstream impact, noting this as another instance of Pyongyang leveraging software vulnerabilities for financial gain. |
| 2026-04-03 2026 | Update anxiety: is it safe to run apt update during active supply chain attack intermediate | Update anxiety: is it safe to run “apt update” during active supply chain attack https://ift.tt/xeBRmYn → cybernews.com |
| 2026-04-03 2026 | Axios NPM Distribution Compromised in Supply Chain Attack news 2 min read | Analysis of the Axios npm supply chain attack details how a compromised maintainer account led to malicious versions (v1.14.1, v0.30.4) being published, introducing a dependency on the trojanized `plain-crypto-js` package. This compromise, tracked as GHSA-fw8c-xr5c-95f9 and MAL-2026-2306, involved a dropper executing platform-specific RATs from `sfrclak.com:8000`. Security teams should audit axios usage, rotate exposed credentials, investigate compromise paths, and monitor for suspicious activity. → wiz.io |
| 2026-04-03 2026 | Axios compromise: How AppSec teams should respond intermediate 6 min read | Library response checklist for the Axios supply chain compromise, detailing steps to audit dependencies, rotate credentials, review CI/CD logs, and secure code repositories. It advocates for continuous dependency inventory, extended SBOMs (xBOMs) including SaaSBOMs and CBOMs, ongoing OSS package monitoring, short-lived CI/CD credentials, and modeling cascading risk, particularly for crypto and fintech assets, to mitigate threats posed by compromised packages like axios and its transitive dependencies. → reversinglabs.com |
| 2026-04-03 2026 | GlassWorm Supply Chain Cyber Attack Threatens Connected Cars news 6 min read | Analysis of GlassWorm, a sophisticated supply chain attack targeting connected car development, highlights its novel use of invisible Unicode characters to conceal malicious payloads. Compromising popular Visual Studio Code extensions on Open VSX and npm packages, GlassWorm harvests developer credentials, VPN configurations, and authentication tokens. Command-and-control operations leverage the Solana blockchain and Google Calendar to exfiltrate data, posing a significant threat to automotive software pipelines and the security of modern vehicles. |
| 2026-04-03 2026 | North Korean hackers bug software used by thousands of US companies in potential crypto heist attempt news 2 min read | Library for securing software supply chains, this resource details a suspected North Korean APT attack leveraging the Axios open-source software. The incident highlights the risks of malicious updates, with potential cryptocurrency theft as a motive. Mandiant and Wiz identify the threat actor, emphasizing the broad economic impact across sectors and the ongoing challenges in assessing downstream consequences. The attack underscores vulnerabilities exploited by sophisticated state-sponsored actors, particularly in the context of AI-driven development. |
| 2026-04-03 2026 | North Korean hackers bug software used by thousands of US companies in potential crypto heist attempt news 2 min read | Writeup of a supply-chain attack targeting the Axios software package, attributed to suspected North Korean hackers. The attackers gained access to a developer's account, pushing malicious updates to thousands of US companies. Experts anticipate a long-term campaign to steal cryptocurrency to fund North Korea's nuclear and missile programs, with downstream impacts potentially taking months to assess. Mandiant and Wiz have commented on the incident, noting the sophistication and boldness of Pyongyang's hacking operations. |
| 2026-04-03 2026 | North Korea-Linked Hackers Hit Axios in Supply Chain Attack news | North Korea-Linked Hackers Hit Axios in Supply Chain Attack https://ift.tt/WXtKrSs |
| 2026-04-02 2026 | Software supply chain hacks trigger wave of intrusions data theft news 3 min read | Analysis of recent supply chain attacks, including the Axios npm compromise by North Korean hackers (UNC1069) and attacks involving Trivy, KICS, LiteLLM, and Telnyx linked to TeamPCP, reveals widespread intrusions and data theft. These incidents have led to stolen secrets being exploited for cloud environment compromises, ransomware, and cryptocurrency theft, impacting numerous organizations globally across various sectors. TeamPCP's activities include exploiting credentials for cloud intrusions and potential partnerships with Vect ransomware and their planned CipherForce RaaS program. → helpnetsecurity.com |
| 2026-04-02 2026 | Et Tu Agent? Did You Install the Backdoor? news 7 min read | Library for detecting novel software supply chain attacks, focusing on malicious dependencies like the one in the Axios incident and the TeamPCP campaign. It analyzes package behavior, examining network access, shell processes, obfuscation, and postinstall scripts, to identify threats that traditional CVE databases and vulnerability scanners miss, offering detection speeds orders of magnitude faster than industry averages. |
| 2026-04-02 2026 | The build pipeline is becoming the new frontline: Axios npm compromise highlights growing software supply chain risks experts warn news 4 min read | Analysis of the Axios npm compromise highlights the escalating risks of software supply chain attacks, where build pipelines become the new frontline. Attackers compromised the Axios npm account, publishing malicious versions that installed a remote access trojan (RAT) targeting macOS, Windows, and Linux. This sophisticated attack involved a staged dependency that self-deleted and cleared its tracks, making detection difficult. Researchers warn that such attacks exploit trust in open-source ecosystems and necessitate closer scrutiny of CI/CD systems, package dependencies, and developer environments to defend against evolving threat actor playbooks, potentially linked to groups like UNC1069. |
| 2026-04-02 2026 | North Korean hackers linked to Axios npm supply chain compromise news 3 min read | Writeup detailing the Axios npm supply chain compromise attributed to North Korean attackers (UNC1069), where malicious versions of the library introduced a hidden dependency with a post-install script to deploy WAVESHAPER.V2 backdoor variants targeting macOS, Windows, and Linux. The attack leveraged stealthy code and external infrastructure to evade detection, highlighting the significant downstream risk of compromised transitive dependencies in the JavaScript ecosystem. → helpnetsecurity.com |
| 2026-04-02 2026 | North Korean hackers behind axios critical supply chain attack Google says news | North Korean hackers behind axios critical supply chain attack, Google says https://ift.tt/bSufe84 → cybernews.com |
| 2026-04-02 2026 | Axios open source library targeted in sophisticated supply chain attack news | Axios open source library targeted in sophisticated supply chain attack https://ift.tt/m7Wu1vD → cybersecuritydive.com |
| 2026-04-02 2026 | North Korea-linked hack hits largely invisible software that powers online services news | North Korea-linked hack hits largely invisible software that powers online services https://ift.tt/SzoMu5C |
| 2026-04-02 2026 | Axios supply chain attack chops away at npm trust news 3 min read | Writeup on the Axios supply chain attack, detailing how compromised credentials led to malicious versions of axios (axios@1.14.1, axios@0.30.4) and a malicious dependency (plain-crypto-js@4.2.1) being published to npm. These versions inject a Remote Access Trojan (RAT) via a post-install script, potentially exposing secrets and leading to full machine compromise. Indicators of compromise include specific domains, IP addresses, and temporary file paths on affected operating systems. |
| 2026-04-02 2026 | LiteLLM Supply Chain Attack Exposes Credentials Across AI Ecosystems news 4 min read | Library detailing a LiteLLM supply chain attack where malicious PyPI packages, injected by threat actor TeamPCP, silently stole credentials and infrastructure data. The multi-stage malware used stealthy execution, harvested sensitive information including cloud credentials and Kubernetes secrets, and established persistence via system-level backdoors and privileged pod deployment. Mitigation strategies involve removing compromised versions, rebuilding systems, rotating credentials, auditing pipelines, and strengthening supply chain security through dependency pinning and verification. → esecurityplanet.com |
| 2025-12-11 2025 | 📚 tl;dr sec 308 news AI | 😈 MCP Security, ☁️ AWS re:Invent Recaps, 🤖 Detecting Malicious Pull Requests with AI https://t.co/gt4zMQKZpp |
| 2025-12-03 2025 | 30 low-high level honeypots in a single PyPI package news Python | https://t.co/sH0hx43Dcp |
| 2025-11-29 2025 | Story of Cyberattack: Salesforce Supply Chain Breach news 5 min read | Analysis of the 2025 Salesforce supply chain attacks, involving compromised Salesloft Drift and Gainsight integrations, highlights the abuse of OAuth tokens and third-party app vulnerabilities. Attackers leveraged stolen credentials and API access to exfiltrate sensitive data from over 200 companies, demonstrating a significant risk inherent in SaaS ecosystems where external applications possess broad permissions and often overlook security controls. |
| 2025-10-30 2025 | fr0gger/proximity: Proximity is a MCP security scanner powered with NOVA intermediate 3 min read AI | Library for security scanning of MCP (Model Context Protocol) servers and Agent Skills. Proximity leverages NOVA security rules to detect issues like prompt injection and jailbreak attempts, offering pattern-specific remediation. It supports MCP Spec 2025-11-25, providing detailed analysis of server capabilities, agent skill structures, permissions, and LLM evaluations. |
| 2025-10-15 2025 | The MCP Security Tool You Probably Need - MCP Snitch intermediate 7 min read AI | Tool for securing MCP proxy operations, MCP Snitch intercepts tool calls and enforces user-defined whitelists to prevent overprivileged access, inspired by browser security evolution. It addresses current authentication weaknesses, such as broad GitHub PAT scopes, by mediating operations and providing visibility and control, acting as a critical layer until MCP protocols and platforms implement native fine-grained, temporal scoping and sandboxing. |
| 2025-07-29 2025 | GitHub - jeanlucdupont/EXEfromCER: PoC that downloads an executable from a public SSL certificate intermediate RCE | Tool for demonstrating executable delivery via SSL certificates. This proof of concept embeds a full Windows executable within a custom extension of an X.509 certificate, served over HTTPS. A Python client connects to the server, extracts the embedded binary from the certificate, saves it to disk, and then executes it, showcasing a novel attack vector. |
| 2024-10-10 2024 | Security hardening for GitHub Actions - GitHub Docs beginner 19 min read | Guide for GitHub Actions security hardening detailing best practices for managing secrets, including the principle of least privilege, masking sensitive data using `::add-mask::`, deleting and rotating exposed secrets, avoiding structured data as secrets, registering transformed or generated secrets, auditing secret handling and usage, and reviewing run logs. It also covers mitigating script injection risks by using JavaScript actions or intermediate environment variables, and emphasizes pinning actions to full-length commit SHAs to prevent malicious code injection from third-party repositories. |
| 2024-09-30 2024 | GitHub - praetorian-inc/gato: GitHub Actions Pipeline Enumeration and Attack Tool intermediate 5 min read | Tool for enumerating and exploiting GitHub Actions pipeline vulnerabilities. Gato, or GitHub Attack Toolkit, identifies poisoned pipeline execution vulnerabilities and scans workflow artifacts for secrets using NoseyParker. It supports various attack modules including GitHub Classic PAT privilege enumeration, GitHub Code Search API enumeration, and self-hosted runner attack detection through workflow file and run-log analysis. This tool has been superseded by Trajan. |
| 2024-07-23 2024 | Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests intermediate | In this article, we’ll discuss some common security malpractices for GitHub Actions and workflows, and how to best avoid them. Our examples are based on real-world GitHub workflow implementation vulne... → securitylab.github.com |
| 2022-01-15 2022 | 10 real-world stories of how weve compromised CI/CD pipelines intermediate 2 min read | Writeups detail 10 real-world compromises of CI/CD pipelines, showcasing vulnerability discovery and exploitation techniques. These NCC Group research articles highlight findings from their Exploit Development Group, emphasizing deep technical investigations and practical guidance for enhancing cyber resilience across various security domains, including software and AI security. |
| 2022-01-10 2022 | Open Source Developer Intentionally Corrupts His Own Widely-Used Libraries news 4 min read | Writeup of the intentional sabotage of the 'colors' and 'faker' JavaScript libraries by their developer, Marak Squires. Versions v1.4.44-liberty-2 of 'colors' and '6.6.6' of 'faker' contained infinite loops and disruptive code, impacting thousands of downstream projects including Amazon's Cloud Development Kit. This event highlights the complexities and potential repercussions of open-source development, particularly concerning developer compensation and corporate reliance on free software. The issue with 'faker' can be mitigated by downgrading to version 5.5.3. |
| 2021-12-29 2021 | Log4j: The Worst Vulnerability In Nearly A Decade? news | Log4j: The Worst Vulnerability In Nearly A Decade? |
| 2021-12-16 2021 | Mitigate Log4j2 / Log4Shell in Elasticsearch intermediate 16 min read RCE | Reference detailing Log4Shell (CVE-2021-44228) and its impact on Elasticsearch versions 5.0 to 7.16.0. It explains mitigation strategies, including updating Log4j to 2.17.1, setting `log4j2.formatMsgNoLookups=true`, removing the `JndiLookup` class, and leveraging the Java Security Manager. The document also addresses subsequent vulnerabilities like CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832, clarifying their applicability to Elasticsearch. |
| 2021-12-13 2021 | Semgrep beginner RCE | Semgrep |
| 2021-12-12 2021 | Digging deeper into Log4Shell - 0Day RCE exploit found in Log4j advanced 6 min read RCE | Writeup on CVE-2021-44228, a critical Remote Code Execution vulnerability in the Apache Log4j library that leverages JNDI lookups. Attackers can exploit this by controlling log messages, triggering LDAP calls to execute arbitrary Java code loaded from attacker-controlled servers, leading to widespread exploitation due to Log4j's common usage. |
| 2021-12-12 2021 | PSA: Log4Shell and the current state of JNDI injection intermediate 2 min read RCE | Writeup on JNDI Injection exploits, including the Log4Shell vulnerability (CVE-2021-44228). This entry details how Java runtimes, even newer versions, are susceptible. It explains that JNDI lookups via RMI and LDAP can lead to remote code execution, referencing earlier patches like CVE-2009-1094 and CVE-2018-3149. The writeup also covers exploitation vectors involving Apache XBean BeanFactory and Java deserialization, highlighting the importance of patching Log4J and disabling JNDI lookups. |
| 2021-11-01 2021 | Common Threat Matrix for CI/CD Pipeline intermediate | Matrix detailing CI/CD pipeline threats, modeled after MITRE ATT&CK®. It classifies adversary tactics and techniques specific to CI/CD environments, extending beyond just supply-chain attacks. This resource aims to share knowledge on securing CI/CD environments with the cybersecurity community, addressing the full attack surface. |
| 2021-10-27 2021 | Protect your open source project from supply chain attacks beginner 5 min read | Library for securing open source projects from supply chain attacks, this resource details best practices aligned with the SLSA framework and OpenSSF Scorecards rubric. It covers techniques such as enforcing multi-factor authentication, requiring commit reviews, using secret manager tools like HashiCorp Vault, implementing least privilege access controls, defining build configurations as code, assessing dependency risks with tools like deps.dev and Scorecards, generating authenticated build provenance, and verifying cryptographically signed artifacts using services like Sigstore. The Allstar project can automate many of these recommendations. |
| 2021-09-15 2021 | Native Container Image Scanning in Amazon ECR beginner 7 min read | Library for native container image scanning within Amazon ECR, leveraging the CoreOS Clair open-source project for static analysis of OS packages against CVEs. This solution offers scheduled re-scans via Lambda functions and an HTTP API, or immediate scans with "scan-on-push" or "scan-on-demand" modes. It integrates with AWS CLI and SDKs, providing actionable insights and enabling drill-down into specific findings, without requiring third-party licenses or infrastructure setup. → aws.amazon.com |
| 2021-06-24 2021 | Google Releases New Framework to Prevent Software Supply Chain Attacks news 2 min read | Framework outlining Supply chain Levels for Software Artifacts (SLSA) to secure the software development pipeline and prevent tampering. SLSA, inspired by Google's Binary Authorization for Borg, offers four progressive security levels for software packages and build platforms, culminating in SLSA 4's two-person review and hermetic build process, aiming to provide auditable metadata for policy engines. → thehackernews.com |
| 2021-05-25 2021 | Supply Chain Security Begins with Secure Software Development beginner 2 min read | Library of open-source tools and practical guidance for secure software development and supply chain security, stemming from NCC Group's vulnerability research across cryptography, hardware, AI, and exploitation. The Exploit Development Group (EDG) delivers high-impact research and bespoke exploit development, with academic partnerships further advancing cyber resilience and nurturing future talent. |
| 2021-05-19 2021 | Creating the Perfect Python Dockerfile intermediate | This content focuses on best practices for building efficient and secure Docker images for Python applications. Key considerations include choosing appropriate base images, minimizing image size through multi-stage builds and `.dockerignore` files, optimizing dependency installation, and implementing security measures like running as a non-root user. The goal is to create Dockerfiles that are faster to build, smaller in size, and more secure for deployment. |
| 2021-05-18 2021 | Colonial Pipeline Darkside and Models news 4 min read | Analysis comparing incident response models from Sophos and Mandiant for the Darkside ransomware attack. It highlights differences in kill chain stages, such as Sophos categorizing at least two steps Mandiant omits, and discrepancies in specific techniques listed for "move laterally," with Mandiant citing Beacon and plink while Sophos lists PSExec and SSH. The entry emphasizes the need for defenders to critically evaluate and unionize such data due to variations in observed post-exploitation actions, referencing CVE-2021-20016. |