Tag
4 articles tagged #Supply Chain Attack.
P.01Enforcement of actions/checkout's pull_request_target protections landed July 20, closing the hole the AsyncAPI attack used six days earlier. What to check.
P.02Seventeen packages published July 7 impersonated real payment SDKs, returned fake success responses, and quietly exfiltrated API keys and cloud credentials.
P.03A GitHub Actions misconfiguration let an attacker open dozens of PRs, steal a privileged bot token, and push a malicious @asyncapi/generator release.
P.04Malicious AI skills and poisoned CLAUDE.md files are now a supply chain attack vector. Here is how the ClawdHub incident worked and what to do about it.