Tag

#Supply Chain Attack

4 articles tagged #Supply Chain Attack.

Cybersecurity/Supply Chain Security·Jul 21, 2026·5 min read

GitHub Actions Just Closed the Pwn Request Window: What actions/checkout v7 Changes

Enforcement of actions/checkout's new pull_request_target protections landed July 20, 2026, closing the exact hole the AsyncAPI attack used six days earlier. Here's what changed, who needs to act, and how to check your own workflows.

GitHub ActionsSupply Chain AttackCybersecurity

Read

Fake Paysafe, Skrill, and Neteller SDKs Hit npm and PyPI in the Same Hour

P.02

Cybersecurity/Supply Chain Security·Jul 21, 2026·5 min read

Fake Paysafe, Skrill, and Neteller SDKs Hit npm and PyPI in the Same Hour

Seventeen packages published July 7, 2026 impersonated real payment SDKs, returned fake success responses, and quietly exfiltrated API keys and cloud credentials. Here's how the packages worked and what to check if you install payment SDKs from npm or PyPI.

Supply Chain AttacknpmPyPI

Read

The AsyncAPI Generator Attack: A pull_request_target Misconfig Becomes an npm Compromise

P.03

Cybersecurity/Supply Chain·Jul 15, 2026·5 min read

The AsyncAPI Generator Attack: A pull_request_target Misconfig Becomes an npm Compromise

A GitHub Actions misconfiguration let an attacker open dozens of pull requests, steal a privileged bot token, and push a malicious @asyncapi/generator release to npm. Here's what happened and how to check your own workflows.

Supply Chain AttacknpmGitHub Actions

Read

ClawdHub and the AI Skill Malware Crisis: Supply Chain Attacks Just Found Their Next Target

P.04

Cybersecurity/Security·Feb 28, 2026·15 min read

ClawdHub and the AI Skill Malware Crisis: Supply Chain Attacks Just Found Their Next Target

Malicious AI skills and poisoned CLAUDE.md files are the new supply chain attack vector. We break down the ClawdHub incident, how MCP server exploits work, and what developers must do now.

Supply Chain AttackAI SecurityMalware

Read