All news with #supply chain compromise tag

🚗 Jaguar Land Rover has extended a production shutdown until Wednesday 1 October 2025 after a major cyber incident that halted its Solihull, Halewood and Wolverhampton plants. The company said teams are working with cybersecurity specialists, the NCSC and law enforcement while it investigates, and warned the outage has already cost an estimated £120m in profits and £1.7bn in revenue. Unions have called for government-backed support for suppliers facing bankruptcy amid cascading supply-chain risk.

🔒 This week's recap highlights rapid attacker innovation and urgent remediation: Google patched an actively exploited Chrome zero-day (CVE-2025-10585), while researchers demonstrated a DDR5 RowHammer variant that undermines TRR protections. Dual-use AI tooling and model namespace reuse risks surfaced alongside widespread supply-chain and phishing disruptions. Defenders should prioritize patching, harden model dependencies, and monitor for stealthy loaders.

🔴 A gamer seeking funds for stage 4 sarcoma lost roughly $32,000 after downloading a verified Steam title, Block Blasters, which had a cryptodrainer component added on August 30. The free-to-play game, published by Genesis Interactive and available on Steam from July 30 to September 21, had positive reviews before turning malicious during a live fundraiser by streamer RastalandTV. Investigators identified batch droppers, a Python backdoor and a StealC payload; victims are advised to reset Steam passwords and move digital assets to new wallets.

🎮 Several incidents show attackers distributing malware via trusted gaming channels, including a compromised Endgame Gear OP1w utility, infected early-access Steam titles, and malicious skins on the official Minecraft site. The Endgame Gear installer likely contained the XRed backdoor, while Steam cases involved infostealers such as Trojan.Win32.Lazzzy.gen that harvested cookies and credentials. Users suffered account takeovers and data loss; recommended defenses include up-to-date antivirus, cautious vetting of downloads, and using gaming security modes that minimize disruption.

⚠️ Zscaler ThreatLabz researchers discovered two malicious Python packages, sisaws and secmeasure, that were designed to deliver the SilentSync remote access trojan to Windows hosts. Both packages, uploaded by a user identified as 'CondeTGAPIS' and since removed from PyPI, contained downloader logic that retrieved a second-stage Python payload (via Pastebin) and executed code in memory. SilentSync can execute commands, harvest browser credentials and cookies, capture screenshots, and exfiltrate files, while offering persistence mechanisms across Windows, Linux and macOS.

🪱 Palo Alto Networks Unit 42 is investigating an active supply chain attack in the npm ecosystem driven by a novel self-replicating worm tracked as "Shai-Hulud." The malware has compromised more than 180 packages, including high-impact libraries such as @ctrl/tinycolor, and automates credential theft, repository creation, and propagation across maintainers' packages. Unit 42 assesses with moderate confidence that an LLM assisted in authoring the malicious bash payload. Customers are protected through Cortex Cloud, Prisma Cloud, Cortex XDR and Advanced WildFire, and Unit 42 recommends immediate credential rotation, dependency audits, and enforcement of MFA.

🔎 From Sept 14–16, more than 180 NPM packages were compromised in the Shai-Hulud worm. The malware propagated by pushing malicious changes to other packages and exfiltrated secrets by publishing data to public GitHub repositories. Using the GitHub Events Archive, UpGuard identified 207 affected repos (175 labeled "Shai-Hulud Migration", 33 "Shai-Hulud Repository"), mapping to 37 users and a set of corporate employers. Affected developers have removed leaked files, but organizations should still audit exposed repos and rotate secrets.

🪱 Researchers have identified a self-propagating npm worm dubbed Shai-Hulud that injects a 3MB+ JavaScript bundle into packages published from compromised developer accounts. A postinstall action executes the bundle to harvest npm, GitHub, AWS and GCP tokens and to run TruffleHog for broader secret discovery. The worm creates public GitHub repositories to dump secrets, pushes malicious Actions to exfiltrate tokens, and has exposed at least 700 repositories; vendors urge rotation of affected tokens.

🛡️ This report analyzes the Sept 14–16 campaign that compromised over 180 NPM packages and propagated the self‑replicating Shai‑Hulud worm, which pushed malicious changes and exfiltrated secrets by publishing data.json files to public GitHub repositories. By parsing the GitHub events archive, researchers identified 207 affected repositories tied to 37 users and attributed those users to 17 employers. Several infected users were NPM maintainers who acted as “super spreaders.” Although exposed files were removed, archived events enable retrospective reconstruction and demand urgent auditing and remediation.

🛡️ Researchers disclosed a campaign that trojanized more than 40 npm packages, including the popular tinycolor, embedding self-replicating credential-stealing code. The malware harvested AWS, GCP and Azure credentials, used TruffleHog for secrets discovery, and established persistence via GitHub Actions backdoors. Affected packages were removed, but developers are urged to remove compromised versions, rebuild from clean caches, and rotate any exposed credentials.

🐛 Security researchers report at least 187 npm packages compromised in an active supply-chain campaign dubbed Shai‑Hulud. The malware, first observed in the widely used @ctrl/tinycolor package, includes a self‑propagating payload that injects a bundle.js, abuses TruffleHog to harvest tokens and cloud credentials, and creates unauthorized GitHub Actions workflows to exfiltrate secrets. Affected vendors including CrowdStrike say they removed malicious packages and rotated keys; developers are urged to audit environments, rotate secrets, and pin dependencies.

🦠 On the evening of September 15 a worm-like supply-chain attack began targeting popular npm components, compromising nearly 150 packages including @ctrl/tinycolor. Malicious code was added as a cross-platform postinstall script (bundle.js) that harvests credentials using a bundled TruffleHog, validates tokens via npm and GitHub APIs, and — where possible — publishes trojanized package updates. Harvested secrets are exfiltrated by creating public GitHub repositories and by deploying GitHub Actions that forward data to an attacker-controlled webhook.

🐛 A self-replicating worm dubbed Shai-Hulud has infected at least 187 NPM packages, stealing developer credentials and publishing them to public GitHub repositories that include the string 'Shai-Hulud'. The malware searches for NPM tokens, uses them to inject itself into the top 20 packages accessible to the token and auto-publishes new versions, and leverages tools such as TruffleHog to locate secrets. The campaign briefly affected multiple packages linked to CrowdStrike and was first observed being modified on Sept. 14.

🔒 Jaguar Land Rover (JLR) has extended its production pause until at least 24 September after a cyber-attack earlier this month. The outage is causing cascading disruption across its supply chain, with some third-party workers reportedly laid off while JLR employees are not facing job losses. Unite has called for government-backed furloughs for affected contractors. A group using the name Scattered Lapsus$ Hunters has claimed responsibility and JLR confirmed some data were affected and regulators have been informed.

🚨 Security researchers say a new software supply chain campaign has compromised more than 40 npm packages by injecting a malicious bundle.js into republished releases. The trojan installs a downloader that executes TruffleHog to scan hosts for secrets and cloud credentials, targeting both Windows and Linux developer environments. Vendors warn maintainers to audit environments, rotate tokens, and remove affected versions to prevent ongoing exfiltration.

⚡ This weekly recap synthesizes critical cyber events and trends, highlighting a new bootkit, AI-enhanced attack tooling, and persistent supply-chain intrusions. HybridPetya samples demonstrate techniques to bypass UEFI Secure Boot, enabling bootkit persistence that can evade AV and survive OS reinstalls. The briefing also covers vendor emergency patches, novel Android RATs, fileless frameworks, and practical patch priorities for defenders.

🚨 Fortinet and Zscaler researchers describe an SEO poisoning campaign that targets Chinese-speaking users by surfacing spoofed download pages and GitHub Pages that host trojanized installers. Attackers manipulated search rankings and registered lookalike domains to trick victims into downloading installers bundling legitimate applications with hidden malware such as HiddenGh0st and Winos. Delivery chains use scripts (for example, nice.js), multi-stage JSON redirects, malicious DLLs and DLL sideloading to evade detection and establish persistence.

⚠️ A threat actor known as WhiteCobra has been publishing malicious VSIX extensions across VS Code Marketplace and OpenVSX, targeting users of VSCode, Cursor, and Windsurf with professionally crafted listings. The campaign comprises at least 24 identified extensions and remains active as the actor quickly re-uploads packages after takedown. Installed extensions execute a small loader that fetches platform-specific payloads; on Windows this chain leads to deployment of LummaStealer, while macOS builds execute a malicious Mach-O. Researchers warn that polished icons, forged descriptions, and inflated download counts were used to lend credibility and trick developers into installing the packages.

🔐 This Unit 42 report describes how compromised OAuth tokens in third‑party integrations create severe supply‑chain exposure, using recent incidents as examples. It highlights three recurring weaknesses: dormant integrations, insecure token storage and long‑lived credentials, and explains how attackers exploit these to exfiltrate data and pivot. The authors recommend token posture management, encrypted secret storage and centralized runtime monitoring to detect and revoke abused tokens quickly.

🌊 Returning from vacation, the author notes headlines shifted away from AI and ransomware toward breaches tied to compromised OAuth tokens and integrations like Salesloft/Drift. The piece emphasizes two converging trends: supply chain risk that now includes datapaths where information is processed, and identity attacks that increasingly target interconnected applications. It highlights Cisco Talos’ CTI-CMM as a practical maturity framework to assess gaps, prioritize investments, and build a roadmap for continuous improvement.