supply chain attack

GlassWASM Malware Hidden in Open VSX Extensions

• Malware

GlassWASM Malware Hidden in Open VSX Extensions

Do Son June 20, 2026 0

GlassWASM malware hides WebAssembly payloads in trojanized Open VSX extensions, abusing Solana memos for stealthy command-and-control.

Mastra Supply Chain Attack Compromises 140+ npm Packages

• Malware

Mastra Supply Chain Attack Compromises 140+ npm Packages

Do Son June 17, 2026 0

A Mastra supply chain attack compromised 140+ npm packages, using the typosquatted easy-day-js dependency to drop a crypto-stealing infostealer.

ShapedPlugin Supply Chain Attack Exposes WordPress Sites

• Malware
• Vulnerability Report

ShapedPlugin Supply Chain Attack Exposes WordPress Sites

Do Son June 16, 2026 0

A ShapedPlugin supply chain attack (CVE-2026-10735) injected malware into WordPress Pro plugins. Discover the impact and how to protect your site today.

Uncanny Automator Breach: Backdoored Plugin Build Hit WordPress Sites

• Data Leak

Uncanny Automator Breach: Backdoored Plugin Build Hit WordPress Sites

Do Son June 15, 2026 0

The Uncanny Automator breach exposed customer data and pushed a backdoored plugin build (7.3.0.5). Here's what happened and how to secure your site.

Massive PyPI Supply Chain Attack Staged via Malware Startup Hooks

• Malware

Massive PyPI Supply Chain Attack Staged via Malware Startup Hooks

Do Son June 7, 2026 0

A massive PyPI supply chain attack has hit developers. Learn how Socket malware detection uncovered the Hades cluster stealing cloud credentials.

Sicoob SDK Banking Malware Exploits NuGet Developer Channels

• Malware

Sicoob SDK Banking Malware Exploits NuGet Developer Channels

Do Son June 3, 2026 0

A dangerous Sicoob SDK banking malware campaign triggers a major NuGet supply chain attack. Learn how it exfiltrates private financial certificates.

macOS Cryptocurrency Malware Powers Stealthy JINX-0164 Operations

• Cybercriminals

macOS Cryptocurrency Malware Powers Stealthy JINX-0164 Operations

Do Son June 3, 2026 0

A dangerous macOS cryptocurrency malware wave drives the latest JINX-0164 developer campaign. Learn how to secure your repositories now.

Weekly Threat Intelligence: May 25 to May 31, 2026

• Weekly Recap

Weekly Threat Intelligence: May 25 to May 31, 2026

Do Son June 1, 2026 0

Read our weekly threat intelligence briefing. Our active vulnerability report reveals new zero-day exploits and CISA KEV additions for May 2026.

Massive npm Dependency Confusion Attack Infiltrates Corporate Ecosystems

• Malware

Massive npm Dependency Confusion Attack Infiltrates Corporate Ecosystems

Do Son May 30, 2026 0

Microsoft uncovers a massive npm dependency confusion attack targeting enterprise infrastructure. Learn how these malicious packages discovered run code.

Microsoft Exposes Malicious Typosquat Cluster Targeting Cloud Environments

• Malware

Microsoft Exposes Malicious Typosquat Cluster Targeting Cloud Environments

Do Son May 29, 2026 0

A critical npm supply chain attack exploits lookalike packages to distribute credential harvesting malware. Learn how to protect your cloud assets.

Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat

• Malware

Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat

Do Son May 25, 2026 0

Security researchers have exposed a malicious Go module backdoor hidden inside the shopsprint/decimal package that executes code using stealthy DNS TXT records.

Malicious JS Lifecycle Hooks Found Hiding Inside PHP Composer Packages

• Malware

Malicious JS Lifecycle Hooks Found Hiding Inside PHP Composer Packages

Do Son May 23, 2026 0

Socket exposes a clever cross-ecosystem supply chain attack targeting PHP packages by hiding a malicious JS postinstall backdoor inside package.json.

Supply Chain Storm: Over 700 Laravel Lang Versions Poisoned with Malicious RCE Backdoor

• Malware

Supply Chain Storm: Over 700 Laravel Lang Versions Poisoned with Malicious RCE Backdoor

Do Son May 23, 2026 0

DevOps Alert: Over 700 laravel-lang localization package versions have been backdoored with a cross-platform 17-collector info-stealer. Audit your logs.

Inside the Breach: How TeamPCP Poisoned a VS Code Extension to Exfiltrate 3,800 GitHub Repositories

• Data Leak

Inside the Breach: How TeamPCP Poisoned a VS Code Extension to Exfiltrate 3,800 GitHub Repositories

Do Son May 20, 2026 0

GitHub confirms a perimeter breach by TeamPCP. An administrative VS Code extension supply-chain worm exfiltrated 3,800 proprietary core source repositories.

The Missed Token: Grafana Labs Suffers Source Code Theft via Shai-Hulud npm Worm Campaign

• Data Leak

The Missed Token: Grafana Labs Suffers Source Code Theft via Shai-Hulud npm Worm Campaign

Do Son May 20, 2026 0

Grafana Labs confirms a targeted cyberattack and source code theft after a missed token from the Mini Shai-Hulud npm worm left a repository exposed.

Shai-Hulud Returns: Massive npm Supply Chain Attack Hijacks AntV Ecosystem to Scrape GitHub Runner Memory

• Malware

Shai-Hulud Returns: Massive npm Supply Chain Attack Hijacks AntV Ecosystem to Scrape GitHub Runner Memory

Do Son May 19, 2026 0

The Mini Shai-Hulud npm worm has hijacked the atool account, poisoning AntV & timeago.js to scrape GitHub runner memory. Execute a full reset now!

Targeting 2 Million Developers: Malicious Nx Console Extension Hijacks VS Code Marketplace

• Malware

Targeting 2 Million Developers: Malicious Nx Console Extension Hijacks VS Code Marketplace

Do Son May 19, 2026 0

Urgent: Malicious Nx Console v18.95.0 briefly hit the VS Code Marketplace, targeting 2M+ installs with a macOS backdoor and token stealer. Audit now!

New “TencShell” Malware Weaponizes Open-Source Rshell via Third-Party Access

• Malware

New “TencShell” Malware Weaponizes Open-Source Rshell via Third-Party Access

Do Son May 18, 2026 0

Cato CTRL intercepts "TencShell," a new stealth malware derived from open-source Rshell. Attackers use third-party access to breach networks!

JDownloader Site Breach Installs Rootkits that Kill Your Antivirus

• Malware

JDownloader Site Breach Installs Rootkits that Kill Your Antivirus

Do Son May 13, 2026 0

Gen Digital exposes a JDownloader site breach (May 6-7, 2026). Attackers used WDAC policies to kill antivirus and r77 rootkits for total system invisibility.

GemStuffer: Attackers Weaponize RubyGems as a Covert Data Drop for UK Gov Scraping

• Malware

GemStuffer: Attackers Weaponize RubyGems as a Covert Data Drop for UK Gov Scraping

Do Son May 13, 2026 0

GemStuffer exploits RubyGems as an illicit data transport to scrape UK council portals. Discover how this supply chain attack bypasses standard defenses.

9.8 Severity Alert: Malicious Git Branches Can Hijack Your WebdriverIO Build Servers

• Vulnerability Report

9.8 Severity Alert: Malicious Git Branches Can Hijack Your WebdriverIO Build Servers

Do Son May 13, 2026 0

Critical Alert: CVE-2026-25244 (CVSS 9.8) in WebdriverIO allows RCE via unsanitized git branch names. Secure your CI/CD pipeline and update to 9.24.0 now.

Supply Chain Siege: 84 TanStack Packages Compromised to Steal GitHub Secrets

• Malware

Supply Chain Siege: 84 TanStack Packages Compromised to Steal GitHub Secrets

Do Son May 12, 2026 0

Urgent: 84 TanStack npm packages hijacked to harvest GitHub Actions secrets. Over 12M weekly downloads impacted. Audit your CI/CD pipelines and rotate tokens.