More results...
Roughly two dozen companies have notified their customers of the Klue-Salesforce incident impact.
The post More Klue Breach Victims Identified as Hackers Get Hacked appeared first on SecurityWeek.
A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.
The post North Korean Hackers Blamed for Mastra NPM Supply Chain Attack appeared first on SecurityWeek.
HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers.
The post More Cybersecurity Firms Disclose Impact From Klue Hack appeared first on SecurityWeek.
The hackers exfiltrated data from Salesforce instances of Klue customers, such as Huntress and Recorded Future.
The post Cybersecurity Firms Impacted by Klue Supply Chain Attack appeared first on SecurityWeek.
Arch Linux suspended account registrations in response to the wave of malicious packages being uploaded to AUR.
The post Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages appeared first on SecurityWeek.
By default, npm install will no longer execute scripts from dependencies, unless explicitly allowed.
The post NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks appeared first on SecurityWeek.
The most recent variants of the self-propagating attacks are named Miasma and Hades.
The post Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks appeared first on SecurityWeek.
CVE Lite CLI is a free, open-source command line tool that scans your projects in seconds and tells you exactly which included packages contain a vulnerability.
The post OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in S…
Hackers published 96 malicious package versions, injected with a credential-stealing worm similar to Mini Shai-Hulud.
The post Supply Chain Attack Hits 32 Red Hat NPM Packages appeared first on SecurityWeek.
Malicious repositories and disguised symlinks can trick AI coding agents into silently installing attacker-controlled MCP servers capable of stealing secrets, compromising CI pipelines, and deploying malicious code.
The post ‘SymJack’ Attack Turns AI C…