Supply chain
Compromised packages, extensions and vendors that reach you through dependencies.
- 19incidents in 30 days
- 4critical
- 15exploited
- 3updated in 24h
Supply chainOpenAI e Anthropic · Exploitation confirmed 
iCollections 9.7.2 para macOS · Exploitation confirmedFake iCollections site for macOS offers DMG flagged as malware
Trezor Safe 5 vendida pela revenda CryptoBilis · Exploitation reportedSuspected Implant in Trezor Safe 5 Sold by Authorized Reseller CryptoBilis
Supply chainRepositórios e branches no GitHub · Exploitation confirmed Gheist: Logs Indicate Over 900 Confirmed Compromises, Says DFIR Report
Supply chainSubQuery @subql/common · Exploitation confirmed Malicious @subql/common 5.8.3 steals credentials and opens backdoor
Supply chaintensorlake · Exploitation confirmed Malicious npm tensorlake release steals credentials and wipes home directory
Supply chainOVHcloud CLI · Exploitation confirmed OVHcloud CLI GitHub releases delivered credential stealer; v0.16.0 fixes it