supply-chain-attack

Cursor says modified Claude Code extension versions 2.1.312 and 2.1.313 were available in its VS Code extension marketplace on October 29 and tried to install an SSH backdoor; it says Anthropic did not develop them and reports it removed them and rotated keys.

TrendAI found 14 npm packages disguised as calendar utilities quietly installing RedShell, a Linux implant tied to the AI-assisted RedC2 4.0 command-and-control framework.

Rust's security team removed a malicious proc-macro1 crate and the arrayref, internment, and append-only-vec crates it compromised, each pulled from crates.io within about 90 minutes.

Kaspersky found official DAEMON Tools Lite installers trojanized from April 8 to May 5, 2026, deploying a multi-stage backdoor to over a dozen targeted machines. CISA added CVE-2026-8398 to its KEV catalog on May 27.

Attackers published lightning 2.6.2 and 2.6.3 to PyPI on April 30, executing an obfuscated JavaScript payload to harvest cloud credentials from anyone who imported the package. Maintainers quarantined the malicious builds within 42 minutes.

A malicious build of @bitwarden/[email protected] was live on npm for roughly 93 minutes on April 22 after attackers used credentials stolen from Checkmarx to push a self-propagating worm that harvests cloud, Git, and AI tooling credentials.

Hackers exploited Anodot's integration with Rockstar's Snowflake cloud to steal nearly 80 million records of financial and analytics data, then published them after the studio refused to pay.

Attackers compromised CPUID's backend API and replaced download links for four popular hardware tools with malware-laden installers, infecting over 150 users across multiple countries.

The European Commission confirms a breach of its AWS-hosted Europa.eu platform after ShinyHunters published over 90 GB of stolen data. CERT-EU traces the intrusion to a supply chain attack on the Trivy security scanner.

Attackers hijacked the primary Axios maintainer's npm account and published two malicious versions that installed a cross-platform remote access trojan, exposing one of the JavaScript ecosystem's most downloaded packages.

Threat actor TeamPCP used credentials stolen in the Trivy compromise to backdoor LiteLLM versions 1.82.7 and 1.82.8 on PyPI, deploying a multi-stage credential stealer across an estimated 500,000 environments.

Sony's anime streaming service confirmed a breach of customer service ticket data after a threat actor compromised a Telus International support agent's credentials, claiming to have stolen 100 GB of user data.