Software supply‑chain & AI attacks on dev ecosystems

Timeline

1. 11 days ago

   [TECHNOLOGY] 2 sources

   Supply‑Chain Malware Surge and Google's AI Code‑Security Preview

   Malicious Shai‑Hulud copies spread on npm, prompting Google to launch CodeMender, an AI tool that scans and auto‑fixes code vulnerabilities.

2. 12 days ago

   [TECHNOLOGY] 2 sources

   Open‑source Software Supply Chain Hit by New Critical Libssh2 Flaw and GitHub Actions Abuse

   Researchers released a public libssh2 exploit (CVE‑2026‑55200) while attackers weaponized malicious GitHub Actions to target cPanel/WHM servers (CVE‑2026‑41940), highlighting severe supply‑chain risks.

3. 13 days ago

   [TECHNOLOGY] 6 sources

   FakeGit campaign spreads SmartLoader malware via 7,600 GitHub repositories

   The FakeGit campaign operates ~7,600 malicious GitHub repos, with 800 posing as AI tools, to deliver SmartLoader malware and the StealC info stealer; AI agents can be duped via 'Agent Baiting', leading to over

4. 15 days ago

   [TECHNOLOGY] 4 sources

   Google Threat Intelligence reports AI‑crafted zero‑day exploit and DarkSword surveillance malware

   Google's Threat Intelligence unveiled the DarkSword exploit chain that records voice, screenshots and data, and disclosed the first AI‑generated zero‑day bypassing 2FA, which was patched before widespread abuse

5. 16 days ago

   [TECHNOLOGY] 2 sources

   Ghostlock Linux Kernel Vulnerability Exposes Root Access After 15‑Year Hideout

   AI tool VEGA uncovered Ghostlock (CVE‑2026‑43499), a 15‑year‑old Linux kernel bug that grants root access, affecting major distributions; vendors are issuing patches as Linus Torvalds backs AI‑assisted kernel‑c

6. 17 days ago

   [TECHNOLOGY] 7 sources

   Emerging Cyber Attack Techniques Target Developer Tools and AI Agents

   Researchers report a supply‑chain attack via malicious Vite npm packages and a new Agent Data Injection method that tricks AI assistants into executing harmful actions, exposing developers to credential theft,

7. 21 days ago

   [TECHNOLOGY] 10 sources

   Microsoft boosts AI‑driven Windows security as cyber attacks target its services

   Microsoft deploys AI to find Windows bugs, leading to larger Patch Tuesdays, as researchers report rising vishing attacks on Microsoft 365, Passkey hijacking, Visual Studio supply‑chain malware and the new Giga

8. 25 days ago

   [TECHNOLOGY] 3 sources

   Linux kernel 'GhostLock' vulnerability and GitHub AI prompt injection expose major security threats

   A Linux kernel use‑after‑free bug (GhostLock, CVE‑2026‑43499) and a GitHub AI prompt‑injection flaw (GitLost) both enable root or private‑code exposure, raising serious security concerns.

9. 25 days ago

   [TECHNOLOGY] 2 sources

   Supply Chain Attacks Compromise NPM Packages and Exploit AI Hallucinations

   Hackers hijacked the @injectivelabs/sdk‑ts npm package to steal crypto keys, while researchers warned that AI‑generated package names are being weaponized in supply‑chain attacks.

10. 27 days ago

    [TECHNOLOGY] 10 sources

    GitHub AI Agentic Workflows Exposed by 'GitLost' Prompt‑Injection Flaw

    GitHub’s Agentic Workflows contain a “GitLost” prompt‑injection bug that lets anyone open a public issue to make the AI agent leak private repository data, bypassing safeguards with a single word.

11. 29 days ago

    [TECHNOLOGY] 2 sources

    Global Cyber Threats: Interpol‑Phishing Scam and TeamPCP Supply‑Chain Attack

    Bitdefender exposed an INTERPOL‑impersonating phishing scam targeting SMEs globally, while the FBI warned that TeamPCP poisoned developer tools to steal cloud credentials and spread malware through supply‑chain

12. about 1 month ago

    [TECHNOLOGY] 2 sources

    Supply Chain Threats Hit Mastra AI and Open‑Source Packages

    TeamPCP’s multi‑vector supply‑chain attack on Mastra AI and a North Korean‑linked PolinRider campaign have poisoned npm, GitHub Actions, Arch Linux, Go modules and other open‑source repositories, compromising ​

13. about 1 month ago

    [TECHNOLOGY] 3 sources

    GitHub Actions flaws expose 300+ repositories to supply‑chain attacks

    Critical flaws in GitHub Actions let attackers hijack over 300 repositories, including Microsoft and Google projects, by exploiting misconfigured CI/CD workflows and stealing tokens.

14. about 1 month ago

    [TECHNOLOGY] 2 sources

    npm and PyPI supply chain attack compromises TanStack, Mistral AI and UiPath packages

    A May 2026 supply‑chain attack flooded npm and PyPI with 401 malicious releases, hitting TanStack, Mistral AI and UiPath packages and prompting urgent security audits.

15. about 2 months ago

    [TECHNOLOGY] 4 sources

    Software supply-chain attacks and AI tool vulnerabilities expose industry security gaps

    TeamPCP compromised over 1,000 open‑source packages, highlighting supply‑chain risks, while a audit of Claude Code uncovered governance failures and CVEs that could steal API keys, prompting new security fixes.

16. about 2 months ago

    [TECHNOLOGY] 2 sources

    Mastra npm and Arch Linux AUR hit by large-scale supply-chain attacks

    Attackers compromised 144 Mastra npm packages and more than 1 500 Arch AUR packages in June 2026, using stolen accounts and AI‑enhanced tools to inject credential‑stealing code, highlighting supply‑chain risks.

17. about 2 months ago

    [TECHNOLOGY] 2 sources

    GitHub to disable automatic npm scripts in v12 to curb supply‑chain attacks

    GitHub announced npm v12 will disable automatic install scripts and block Git and remote URL dependencies by default, requiring explicit approval to reduce supply‑chain attack risk.

18. about 2 months ago

    [TECHNOLOGY] 3 sources

    Microsoft disables 73 GitHub repositories after Miasma worm supply‑chain attack

    Microsoft removed 73 GitHub repositories after the Miasma worm injected malicious commits that stole cloud credentials and leveraged AI coding tools, prompting concerns over software supply‑chain security.

19. about 2 months ago

    [TECHNOLOGY] 2 sources

    GitHub Removes 73 Microsoft Repos After Miasma Malware Attack

    GitHub temporarily disabled 73 Microsoft repos after a compromised account introduced the Miasma worm, causing brief CI/CD disruptions and exposing supply‑chain security risks.

20. about 2 months ago

    [TECHNOLOGY] 7 sources

    Supply chain hack disables 70 Microsoft open‑source projects on GitHub

    Microsoft disabled about 70 open‑source repos on GitHub after a supply‑chain attack injected password‑stealing malware, while GitHub confirmed a separate breach of roughly 3,800 internal repositories tied to a

21. about 2 months ago

    [TECHNOLOGY] 2 sources

    Microsoft warns of malicious npm packages and Miasma worm targeting developer supply chain

    Microsoft flagged two malicious npm packages stealing crypto wallets and credentials, and a Miasma worm that infected 73 Microsoft GitHub repos to harvest cloud access keys, highlighting developer supply‑chain

22. about 2 months ago

    [TECHNOLOGY] 2 sources

    Red Hat packages compromised by Miasma malware supply‑chain attack

    Miasma malware was inserted into 32 Red Hat npm packages via a compromised employee GitHub account, stealing cloud credentials and spreading through automated republishing before being revoked.

23. about 2 months ago

    [TECHNOLOGY] 5 sources

    Supply‑chain attacks on npm and Laravel packages steal cloud credentials and tokens

    Coordinated supply‑chain attacks on npm Red Hat packages and Laravel‑Lang PHP tags stole cloud, browser and token credentials via CI/CD pipelines and malicious autoload code.

24. about 2 months ago

    [TECHNOLOGY] 2 sources

    Microsoft patches critical Exchange and Copilot flaws as new crypto‑wallet malware emerges

    Microsoft warns of npm‑based malware stealing crypto wallets and patches critical Exchange Online and Copilot flaws that could enable data theft and remote code execution.

25. 2 months ago

    [TECHNOLOGY] 2 sources

    Microsoft warns of crypto‑stealing malware hidden in npm packages

    Microsoft flagged two malicious npm packages that deploy a RAT to steal crypto wallet data, using Hugging Face APIs for stealthy exfiltration and raising supply‑chain security concerns for developers.

26. 2 months ago

    [TECHNOLOGY] 2 sources

    Glassworm botnet taken offline after coordinated takedown

    CrowdStrike, Google and The Shadowserver Foundation dismantled the Glassworm botnet on 26 May 2026, cutting its four C2 channels that targeted developers via supply‑chain attacks.

27. 2 months ago

    [TECHNOLOGY] 5 sources

    Supply chain attacks on CI/CD pipelines expose developer credentials

    Supply‑chain attacks on npm packages and GitHub Actions have leaked cloud and code‑repository credentials from CI/CD pipelines, prompting calls for tighter pipeline security.

28. 2 months ago

    [TECHNOLOGY] 3 sources

    Malicious npm packages steal AI developer credentials from Claude and OpenAI tools

    Two malicious npm packages targeting Claude and OpenAI Codex tools exfiltrated files and stole long‑lived developer tokens, prompting warnings about AI supply‑chain security.

29. 2 months ago

    [TECHNOLOGY] 2 sources

    TrapDoor Malware Campaign Targets Developers on npm, PyPI and Crates.io

    TrapDoor malware infected 34 packages on npm, PyPI and Crates.io, targeting crypto developers and using hidden Unicode tricks to fool AI coding assistants, prompting security concerns.

30. 2 months ago

    [TECHNOLOGY] 5 sources

    Glassworm malware takedown halts developer supply‑chain attacks

    CrowdStrike, Google and Shadowserver disabled the Glassworm botnet’s four C2 channels, ending a supply‑chain attack that compromised developer tools, stole credentials and crypto wallets.

31. 2 months ago

    [TECHNOLOGY] 5 sources

    TrapDoor malware campaign compromises crypto and AI developer tools

    The TrapDoor supply‑chain attack spreads fake npm, PyPI and Rust packages, stealing crypto wallets, API keys and cloud credentials from developers and targeting AI coding assistants.

32. 2 months ago

    [TECHNOLOGY] 2 sources

    Supply‑chain malware campaign infects npm and PyPI packages, steals credentials from OpenAI and Mistral AI

    A supply‑chain attack on npm and PyPI packages, called “Mini Shai‑Hulud,” stole cloud credentials from OpenAI, Mistral AI and many other apps; TeamPCP also compromised GitHub repos.

33. 3 months ago

    [TECHNOLOGY] 15 sources

    Mini Shai-Hulud supply-chain attack compromises OpenAI devices and triggers macOS certificate rotation

    Mini Shai-Hulud npm supply-chain attack hit OpenAI, forcing macOS code‑signing certificate rotation and prompting a $25k sale of stolen Mistral AI code.