#supply-chain

Adobe ColdFusion and Gitea flaws were exploited within hours of disclosure, while a wave of AI coding assistant vulnerabilities and npm supply chain compromises exposed source code, credentials, and cryptocurrency wallets.

A coordinated supply chain attack poisoned 20 LeoPlatform npm packages in under three seconds, deploying malware that silently drains your GitHub tokens, cloud credentials, and package registry secrets using your own GitHub account to smuggle the data out.

Source: Socket | StepSecurity

Walk into almost any food warehouse in India today, and you will likely find the same scene: stacks of packaged goods, a busy team moving stock in and out, and somewhere in the middle of it all, at least a few items quietly sitting past their prime. Knowing how to track expiry date in inventory properly is one of the most underrated skills in food distribution — and yet it is one of the biggest…

Malicious AI “skills” in the OpenClaw ecosystem are being used to distribute infostealers and manipulate financial workflows, showing how AI agent marketplaces are emerging as a new supply chain attack surface.

Source: Palo Alto Networks Unit 42

Trojanised npm packages impersonating PostCSS utilities are being used to deploy a multi-stage Windows RAT, stealing browser credentials and establishing persistent command-and-control access.

Source: JFrog Security Research

A breach at Klue exposed customer data after attackers used compromised integration credentials to access connected cloud systems, impacting multiple organisations including cybersecurity vendors. The Icarus group claimed responsibility and threatened data leaks after exfiltrating information such as business contact records from platforms like Salesforce.

Source: Klue

A compromised update to Hola Browser for Windows silently installed a Monero mining payload that evaded detection by adding Defender exclusions and persisting through a malicious system service. The supply chain attack affected a subset of users and leveraged the vendor’s distribution pipeline to deploy mining software that activated when systems were idle.

Source: Kaspersky