#ComPromiseD

More and more often popular software packages are compromised, leading to stolen api keys, tokens,...

An automated campaign named Gheist uses stolen GitHub tokens to inject workflows into repositories, printing secrets into Actions logs for exfiltration. Wi

Leveraging an innovative attack vector that targeted thousands of AI servers, a recent botnet used poetry to build a network of interconnected crypto miners.

Hackers managed to trick Meta’s AI-powered support bot into allowing them to take over a number of Instagram accounts, including...

Ongoing Shai-Halud npm supply chain attacks affected popular packages. Vercel responded swiftly, secured builds, and notified impacted users.

Vercel updates that no Vercel-managed systems or internal build processes were impacted by the Shai-Halud 2.0 supply chain compromise

Axios package compromise and remediation steps. The axios npm package was compromised in an active supply chain attack discovered on March 31, 2026.

Over the last few weeks, supply chain security has once again become a very real problem for...

From Latest from Tom's Hardware: Compromised Mistral AI and TanStack packages may have exposed GitHub, cloud and CI/CD credentials in 'mini Shai Hulud' malware infection — supply-chain campaign spreads across npm and AI developer ecosystems like wildfire

The TanStack npm compromise wasn't sophisticated — one maintainer's token was enough. Here are the three changes that actually shrink your blast radius.

Authorities have invoked culpable homicide charges after a Class 9 student succumbed to injuries caused by falling debris at a site lacking mandatory safety nets.

JDownloader's official website was compromised via a CMS vulnerability, allowing attackers to replace legitimate Windows and Linux installers with malware-laden versions.…

Short answer If your wallet was drained again after you moved funds, it usually means the original...

The official website for JDownloader was recently compromised in a supply chain attack between May 6...

From Dev.to - security: State-Sponsored Hackers Are Exploiting Palo Alto Firewalls Right Now – And There's No Patch Yet

From Gulfnews RSS Feed: In a world of outages and AI threats, passwords are no longer enough

From Dev.to - security: No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours

The official Daemon Tools website was compromised to distribute trojanized software installers (versions 12.5.0.2421-12.5.0.2434) that deliver backdoors and a complex QUIC RAT to thousands of users worldwide.…

From Reddit - r/cybersecurity: Official SAP npm packages compromised to steal credentials

From Reddit - r/cybersecurity: SAP-Related npm Packages Compromised in Credential-Stealing Supply Chain Attack