Supply chain

Compromised packages, extensions and vendors that reach you through dependencies.

19incidents in 30 days
4critical
15exploited
3updated in 24h

Videostrong Technology Set-top boxes Android… · Exploitation confirmed

Google Dismantles 1.3 Million TV Box Botnet; Factory Backdoor Remains

Google and partners dismantled the XCPE botnet of more than 1.3 million Android TV set-top boxes and took down its command servers. Google says Chinese manufacturer Videostrong shipped the x.cpe backdoor in factory firmware and sold access to criminals, who used the boxes as residential proxies and for ad fraud. The backdoor remains in firmware, reinstalls after restart and cannot be removed by owners; affected devices, seen in 182 models, should be replaced.

Nov 03, 2026 · 3 min read

Anthropic Extensão Claude Code para VS Code… · Exploitation confirmed
Cursor Confirms Claude Code Extension Backdoor; Up to 5,000 Hit
Nov 02, 2026 · 3 min read
Supply chainLiteLLM · Exploitation confirmed
LiteLLM ties malicious 1.107.0 to leaked key; users must rotate credentials
Oct 26, 2026 · 2 min read
Supply chaineMudhra · Exploitation confirmed
Eight eMudhra intermediate CA keys were recoverable; fixes released
Oct 26, 2026 · 1 min read
Nikke · Exploitation reported
Reports of malware in Nikke PC client remain unconfirmed
Nov 03, 2026 · 2 min read
Supply chainBuild customizado do Windows 10 distribuído a… · Exploitation confirmed
NetamLoader malware infects custom Windows 10 used by Asian governments
Nov 01, 2026 · 2 min read
Supply chainRepositórios e GitHub Actions · Exploitation confirmed
GhostAction: 22,964 Repositories Targeted, 1,792 Accounts Compromised, Stolen Tokens Reused
Oct 28, 2026 · 2 min read
Supply chainSistemas de atualização das ferramentas de… · Exploitation confirmed
Jurojin confirms tampered updates; malware exposed players' hole cards
Oct 29, 2026 · 1 min read
Supply chainnpm / GitHub Pacotes npm da campanha testmetest · Exploitation confirmed
testmetest npm campaign armed 42 real GitHub repositories, JFrog says
Oct 28, 2026 · 1 min read
Supply chainHugging Face · Exploitation confirmed
Malware campaign returns to Hugging Face, hijacks GPUs for mining
Oct 30, 2026 · 2 min read
Supply chainGNU Project GNU Savannah · Exploitation reported
Researchers hacked GNU Savannah; FSF fixed 26 flaws and published report
Nov 02, 2026 · 2 min read
Supply chainVários projetos de código aberto Repositórios… · Exploitation reported
Rigged posts on 61 GitHub repos target CI pipeline secrets
Oct 30, 2026 · 1 min read
Supply chainOpenAI e Anthropic · Exploitation confirmed
Fake ChatGPT and Claude Apps on GitHub Install XMRig Miner
Oct 29, 2026 · 1 min read

Google Dismantles 1.3 Million TV Box Botnet; Factory Backdoor Remains

Cursor Confirms Claude Code Extension Backdoor; Up to 5,000 Hit

LiteLLM ties malicious 1.107.0 to leaked key; users must rotate credentials

Eight eMudhra intermediate CA keys were recoverable; fixes released

Reports of malware in Nikke PC client remain unconfirmed

NetamLoader malware infects custom Windows 10 used by Asian governments

GhostAction: 22,964 Repositories Targeted, 1,792 Accounts Compromised, Stolen Tokens Reused

Jurojin confirms tampered updates; malware exposed players' hole cards

testmetest npm campaign armed 42 real GitHub repositories, JFrog says

Malware campaign returns to Hugging Face, hijacks GPUs for mining

Researchers hacked GNU Savannah; FSF fixed 26 flaws and published report

Rigged posts on 61 GitHub repos target CI pipeline secrets

Fake ChatGPT and Claude Apps on GitHub Install XMRig Miner

Supply chain: get new ones every morning