Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.

The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek.

Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework.

The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek.

Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.

The post Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek.

A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers.

The post $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant appeared first on SecurityWeek.

Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign.

The post Long-Running NPM Malware Campaign Accumulates 40,000 Downloads appeared first on SecurityWeek.