Attackers are increasingly focusing on CI/CD pipelines and developer tools rather than application code itself, exploiting gaps in the software development lifecycle supply chain. Organizations need comprehensive visibility across their entire SDLC and implement rigorous security controls to defend these overlooked but critical infrastructure components.
Researchers discovered 14 malicious npm packages disguised as calendar and streak utilities that deliver RedC2 4.0, an AI-powered Linux backdoor to infected systems. Upon installation, the trojanized packages extract and execute a bundled binary as a background process to establish command and control. This supply chain attack demonstrates how legitimate package repositories remain a vector for distributing sophisticated implants with AI-assisted capabilities.
The bank said there is no evidence that its own systems, networks or data repositories were compromised.
Attackers have compromised popular Rust package repositories by injecting malicious code into legitimate crates, transforming standard build processes into vehicles for distributing infostealer malware. The poisoned packages targeted developer credentials, leveraging the trust developers place in established Rust dependencies to compromise their systems and sensitive authentication data.
Threat actors linked to North Korea compromised the Rust supply chain by distributing a malicious version of the arrayref package that introduced a dependency designed to retrieve and execute a malicious payload from a remote server. This attack demonstrates the continued targeting of open-source ecosystems by state-sponsored groups seeking to distribute malware at scale through trusted development dependencies.
A compromised maintainer account was used to publish malicious versions of three popular Rust crates—arrayref, internment, and append-only-vec—that injected a typosquatted dependency designed to download and execute arbitrary code during the build process. The Rust Project has since removed these poisoned releases from crates.io, though the affected versions had accumulated over 245 million downloads across their histories. This supply chain attack demonstrates the risk of build-time code execution in dependency management, where malicious payloads can be triggered silently during compilation rather than at runtime.
Malicious versions of the arrayref Rust crate and other packages executed backdoors during the compilation process, representing a significant supply chain threat to developers using these dependencies. The attack infrastructure shows considerable overlap with recent North Korean-attributed supply chain campaigns targeting Mastra and axios, suggesting a potential connection or shared operational infrastructure between these threat actors.
Recorded Future has integrated native risk ratings capabilities directly into its Third-Party Risk product, enabling security teams to access threat intelligence and risk assessments within a unified workflow. This consolidation aims to streamline third-party risk management by eliminating the need to switch between separate tools for threat data and risk evaluation.
The expensive attacks are not always the clever ones. This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely. So, nothing magical. Just a
A worm dubbed ChainDrop, using the Shai-Hulud variant, has compromised 444 npm packages and propagated through both tarballs and developer tool hooks to evade standard security detection mechanisms. The attack demonstrates a sophisticated supply chain infiltration method targeting the npm ecosystem at scale. The worm's ability to spread through multiple infection vectors highlights the challenges in securing dependency management systems against determined adversaries.
Trezor has confirmed that a logistics breach compromised the personal details of approximately 13,000 customers, highlighting how supply chain vulnerabilities can undermine the security posture of hardware wallet manufacturers. The incident demonstrates that even companies offering advanced security features remain exposed to third-party operational failures beyond their direct control.
Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix.
Elastic Security Labs has detected the return of the Shai-Hulud threat actor, who compromised the keyv package maintainer to deploy the CHAINDROP worm across 400+ npm packages. The worm leverages stolen npm credentials to inject backdoors into co-owned packages that collectively receive over 1.3 billion monthly downloads, creating significant supply-chain risk across the JavaScript ecosystem.
A credential-stealing worm distributed through over 400 compromised npm packages propagated itself across software ecosystems by automatically republishing malicious updates. Microsoft's analysis of the ChainDrop campaign reveals the complete attack chain and affected environments, alongside detection and remediation guidance for security teams.