8 stories
incident · supply chain External source
OPSSHIELD says attackers used its cPGuard update channel to send a malicious update on November 2. Its later disclosure describes roughly 70 minutes of malicious distribution and exposure of root-level secrets, superseding the vendor’s earlier account.
incident · supply chain External source
MotherSphere’s NIKKE investigation describes tampered scripts on Level Infinite’s CDN loading a remote-control agent. Follow-up reporting describes credential-stealing capabilities and warns that updated launcher cleanup can erase evidence of an earlier infection.
incident · supply chain External source
Socket’s November 6 analysis links strutil-core 1.0.1, published November 1, to an install-time credential stealer and AI tool persistence. It was a standalone malicious gem; victims and successful downstream infections remain unconfirmed.
incident · supply chain
Cloudflare now reports certificates apparently forged with eMudhra’s weak intermediate keys and about 22,000 attempted handshakes in its telemetry. It has not seen interception of its own connections. Its challenge probes suggest some embedded browsers still accept affected chains, with a skewed traffic sample.
incident · supply chain External source
Cursor reported that tampered Claude Code extension builds were served from its marketplace on October 29. Microsoft found an injected loader that attempted SSH access and persistence. The evidence is specific to Cursor distribution; successful remote access depends on host conditions.
incident · supply chain
LiteLLM’s investigation connects an October 10 secret-stealing workflow to the October 21 publication of compromised litellm==1.107.0 artifacts. Socket independently found traces of the earlier workflow. The maintainer says token hashes link a stolen maintainer credential to approval of the later release.
incident · supply chain
Socket’s October investigation found malicious GitHub Actions workflows added through compromised maintainer accounts. Its initial case study covered 346 repositories; a later update identified a wider set of accounts and repositories. The workflow sought both CI secrets and credentials exposed in source or git history.
incident · supply chain
Socket’s package analysis identifies malicious releases in both the MemTensor npm plugin and the MemoryOS package on PyPI. The packages included a Go binary that searched developer environments for secrets. This is one distribution compromise spanning two registries, not two unrelated stories.