Latest Supply Chain Attack news

Hacker says hijacking libraries, stealing AWS keys was ethical research

The hacker of 'ctx' and 'PHPass' libraries has now broken silence and explained the reasons behind this hijack to BleepingComputer. According to the hacker, this was a bug bounty exercise and no malicious activity was intended.
- Ax Sharma
- May 25, 2022
- 09:42 AM
- 2
Popular Python and PHP libraries hijacked to steal AWS keys

PyPI module 'ctx' that gets downloaded over 20,000 times a week has been compromised in a software supply chain attack with malicious versions stealing the developer's environment variables. Additionally, versions of a 'phpass' fork published to the PHP/Composer package repository Packagist had been altered to steal secrets.
- Ax Sharma
- May 24, 2022
- 07:42 AM
- 0
FBI, CISA, and NSA warn of hackers increasingly targeting MSPs

Members of the Five Eyes (FVEY) intelligence alliance today warned managed service providers (MSPs) and their customers that they're increasingly targeted by supply chain attacks.
- Sergiu Gatlan
- May 11, 2022
- 08:29 AM
- 1
Check your gems: RubyGems fixes unauthorized package takeover bug

The RubyGems package repository has fixed a critical vulnerability that would allow anyone to unpublish ("yank") certain Ruby packages from the repository and republish their tainted or malicious versions with the same file names and version numbers.
- Ax Sharma
- May 08, 2022
- 04:59 PM
- 0
Open source 'Package Analysis' tool finds malicious npm, PyPI packages

The Open Source Security Foundation (OpenSSF), a Linux Foundation-backed initiative has released its first prototype version of the 'Package Analysis' tool that aims to catch and counter malicious attacks on open source registries. the open source tool released on GitHub was able to identify over 200 malicious npm and PyPI packages.
- Ax Sharma
- May 01, 2022
- 11:42 AM
- 1
NPM flaw let attackers add anyone as maintainer to malicious packages

A logical flaw in the npm registry, dubbed 'package planting' let authors of malicious packages quietly add anyone and any number of users as 'maintainers' to their packages in an attempt to boost the trust in their package.
- Ax Sharma
- April 28, 2022
- 07:19 AM
- 0
Third npm protestware: 'event-source-polyfill' calls Russia out

Developers are increasingly voicing their opinions through their open source projects in active use by thousands of software applications and organizations. Most recently, the developer of the 'event-source-polyfill' npm package peacefully protested Russia's "unreasonable invasion" of Ukraine, to Russian consumers.
- Ax Sharma
- April 11, 2022
- 05:02 PM
- 0
BIG sabotage: Famous npm package deletes files to protest Ukraine war

This week, the developer of the popular npm package 'node-ipc' released sabotaged versions of the library in protest of the ongoing Russo-Ukrainian War. The 'node-ipc' package, which gets downloaded over a million times weekly, began deleting files on developer's machines, in addition to creating new text files with "peace" messages.
- Ax Sharma
- March 17, 2022
- 05:51 AM
- 12
Russian government sites hacked in supply chain attack

Russia says some of its federal agencies' websites were compromised on Tuesday after unknown attackers hacked the stats widget used to track the number of visitors by multiple government agencies.
- Sergiu Gatlan
- March 09, 2022
- 09:52 AM
- 0
Over 90 WordPress themes, plugins backdoored in supply chain attack

A massive supply chain attack compromised 93 WordPress themes and plugins to contain a backdoor, giving threat-actors full access to websites.
- Bill Toulas
- January 21, 2022
- 10:34 AM
- 0
Dev corrupts NPM libs 'colors' and 'faker' breaking thousands of apps

Users of popular open-source libraries 'colors' and 'faker' were left stunned after they saw their applications, using these libraries, printing gibberish data and breaking. Some surmised if the NPM libraries had been compromised, but it turns out there's more to the story.
- Ax Sharma
- January 09, 2022
- 09:17 AM
- 32
Hackers use video player to steal credit cards from over 100 sites

Hackers used a cloud video hosting service to perform a supply chain attack on over one hundred real estate sites that injected malicious scripts to steal information inputted in website forms.
- Bill Toulas
- January 04, 2022
- 12:52 PM
- 0
Fujitsu pins Japanese govt data breach on stolen ProjectWEB accounts

Fujitsu says the attackers behind the May data breach used a vulnerability in the company's ProjectWEB information-sharing tool to steal accounts from legitimate users and access proprietary data belonging to multiple Japanese government agencies.
- Sergiu Gatlan
- December 09, 2021
- 07:47 AM
- 0
Invisible characters could be hiding backdoors in your JavaScript code

Could malicious backdoors be hiding in your code, that otherwise appears perfectly clean to the human eye and text editors alike? A security researcher has shed light on how invisible characters can be snuck into JavaScript code to introduce security risks, like backdoors, into your software.
- Ax Sharma
- November 10, 2021
- 08:18 AM
- 1
Popular 'coa' NPM library hijacked to steal user passwords

Popular npm library 'coa' was hijacked today with malicious code injected into it, ephemerally impacting React pipelines around the world. The 'coa' library, short for Command-Option-Argument, receives about 9 million weekly downloads on npm, and is used by almost 5 million open source repositories on GitHub.
- Ax Sharma
- November 04, 2021
- 02:06 PM
- 1
'Trojan Source' attack method can hide bugs into open-source code

Academic researchers have released details about a new attack method they call "Trojan Source" that allows injecting vulnerabilities into the source code of a software project in a way that human reviewers can't detect.
- Ionut Ilascu
- November 01, 2021
- 08:07 PM
- 0
Microsoft: Russian SVR hacked at least 14 IT supply chain firms since May

Microsoft says the Russian-backed Nobelium threat group behind last year's SolarWinds hack is still targeting the global IT supply chain, with 140 resellers and technology service providers attacked and at least 14 breached since May 2021.
- Sergiu Gatlan
- October 25, 2021
- 04:37 AM
- 0
US govt sites showing porn, viagra ads share a common software vendor

Multiple U.S. government sites using .gov and .mil domains have been seen hosting porn and spam content, such as Viagra ads, in the last year. A security researcher noticed all of these sites share a common software vendor, Laserfiche.
- Ax Sharma
- September 17, 2021
- 06:11 AM
- 1
Autodesk reveals it was targeted by Russian SolarWinds hackers

Autodesk has confirmed that it was also targeted by the Russian state hackers behind the large-scale SolarWinds Orion supply-chain attack, almost nine months after discovering that one of its servers was backdoored with Sunburst malware.
- Sergiu Gatlan
- September 02, 2021
- 07:30 AM
- 0
PyPI packages caught stealing credit card numbers, Discord tokens

The Python Package Index (PyPI) registry has removed several Python packages this week aimed at stealing users' credit card numbers, Discord tokens, and granting arbitrary code execution capabilities to attackers. These malicious packages were downloaded over 30,000 times according to the researchers who caught them.
- Ax Sharma
- July 30, 2021
- 08:18 AM
- 0