#supply chain

Deep Dive

Malicious Hugging Face model repositories ran cryptominers and backdoors on GPU hosts that loaded them; the campaign returned after each takedown.

Deep Dive

Stolen GitHub tokens pushed 72,026 malicious commits to 22,964 repositories in nine days; revoke the tokens and hunt the #ghc2 cron job.

Deep Dive

An npm worm stole credentials, planted AI-tool hooks in 42 real GitHub repositories and hid a package publisher; treat installs as compromises.

Deep Dive

A malicious Claude Code extension 2.1.313 on the Cursor Marketplace added an SSH backdoor; at most 5,000 users installed it on October 29, 2026.

Deep Dive

Swapped archives on five OVHcloud CLI releases delivered a secret-stealing build for 94 minutes on October 19, 2026; rotate every secret and install v0.16.0.

Deep Dive

A threat actor hijacked LiteLLM's release pipeline with a leaked, never-revoked master key and pushed a malicious 1.107.0 to PyPI and Docker on October 21, 2026. The wheel installs Python startup files that steal credentials and open an hourly backdoor even when LiteLLM is never imported. PyPI quarantined the version after 1 hour 44 minutes; anyone who installed it must rebuild the environment and rotate every reachable secret.

Security

E.V.A Information Security uncovered critical vulnerabilities in CocoaPods, leading to immediate patches, and developers must now remove unclaimed packages, verify dependencies, and scan their applications to ensure security.

Security

The article delves into dependency confusion vulnerabilities and introduces a novel detection and exploitation technique then provides actionable steps to mitigate the risks associated with this vulnerability.