Rank Math PRO WordPress Plugin Compromised in Supply-Chain Attack
The Rank Math PRO WordPress plugin was compromised via its official vendor site, distributing malware with hidden backdoors that affect numerous websites.
Tag
#Supply Chain Attack
23 results in the archive.
Attackers Delivered Backdoor via AOMEI Backupper Update Server Tampering
Between May and July 2026, attackers intermittently modified files on AOMEI Backupper's update servers to deliver a backdoor to Windows systems updating during specific periods, representing a supply-chain compromise.
Ledger Confirms Spy Chip Implant Behind Crypto Wallet Thefts
Ledger confirmed that hardware wallets sold via a Southeast Asian reseller were compromised with spy chip implants, enabling cryptocurrency thefts and demonstrating critical supply chain risks.
FakeGit Malware Campaign Relaunches with Over 17,600 Malicious GitHub Repos
The FakeGit malware campaign has resurfaced with more than 17,600 malicious GitHub repositories distributing SmartLoader malware and the StealC infostealer, posing risks to developers and open-source security.
Eight Malicious npm Packages Delivered Overlord RAT and Stealer
Researchers uncovered 12 malicious npm packages, including eight delivering Overlord RAT and stealers, downloaded over 40,000 times since August 2023, posing supply chain risks to npm users.
Compromised GitHub Actions Resume Mini Shai-Hulud Malware Execution
Two GitHub Actions repositories compromised during the May 2026 Mini Shai-Hulud campaign resumed malware execution after recent unauthorized access, highlighting risks in CI/CD supply chains.
CrowdSec Private GitHub Repos Copied in TanStack npm Supply Chain Attack
An attacker accessed about 170 private CrowdSec GitHub repositories using stolen credentials from the May TanStack npm supply chain attack, exploiting a compromised former employee account.
Brevo Supply-Chain Attack Injected Malicious Scripts on Customer Sites
Attackers compromised Brevo by stealing a Cloudflare API key and injecting malicious scripts into Brevo and its customers' websites, resulting in malware distribution via a supply-chain attack.
Attacker Hijacks AI Coding Assistant, Spreads Malware Across 100 Repos
An attacker hijacked an AI coding assistant session to distribute the Shai-Hulud worm within approximately 100 internal code repositories at a SaaS provider, resulting in theft of repository secrets and source code.
Coder’s registry compromised to distribute malicious Terraform modules
Attackers breached Coder's Cloudflare infrastructure to push malicious Terraform modules that embed credential-stealing code, threatening developer credentials.
BGP Hijack Delivers Malicious Virtualizor Update with Root Access
Attackers leveraged a BGP hijack to redirect Softaculous update traffic, delivering a malicious Virtualizor update that established persistent root access on five hypervisors.
Australia Arrests Suspected TeamPCP Hackers Behind Supply Chain Attacks
Australian authorities arrested two men linked to the TeamPCP group known for extensive developer supply chain attacks, disrupting a significant threat actor.
Trojanized npm Packages Deploy AI-Powered RedC2 4.0 Linux Backdoor
Researchers identified 14 malicious npm packages that deploy RedC2 4.0, an AI-assisted Linux backdoor, leveraging open-source supply chain compromise for stealthy persistence.
Hackers Compromise Rust Crate to Deliver Infostealer Malware
Attackers compromised the maintainer account of the Rust crate arrayref to inject malware that executes on developer systems during compilation, risking exposure of sensitive data.
Malicious LiteLLM Releases Linked to Trivy Hack Expose 2,100+ Orgs
Two malicious LiteLLM packages on PyPI in March contained credential-stealing code that potentially exposed over 2,100 organizations by capturing cloud and system secrets.
ChainDrop Malware Infects 1,300+ npm Packages in Supply-Chain Attack
The ChainDrop malware has compromised over 1,300 npm packages, impacting software supply chain security with billions of downloads monthly.
Adform's Ad Script Compromised to Steal Cryptocurrency via Clipboard Hijack
Adform's advertising scripts were compromised in a supply-chain attack that hijacks clipboard cryptocurrency addresses to redirect funds to attackers.
Amazon Attributes Debug and Chalk NPM Supply Chain Attacks to North Korean Hackers
Amazon attributes multiple supply chain attacks on the Debug and Chalk npm packages to North Korean state-sponsored hackers, exposing risks to open-source software security.
ShinyHunters Gang Claims Ernst & Young Data Breach via Supply-Chain Attack
The ShinyHunters extortion gang claimed responsibility for a data breach at Ernst & Young obtained through a supply-chain attack involving stolen system credentials.
Hackers Abuse ViPNet Updates to Target Russian Government Agencies
An advanced threat actor exploits the update mechanism of ViPNet private networking software to attack Russian government agencies, illustrating ongoing espionage.
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT
Seven malicious npm packages in the Vite ecosystem use a four-tier blockchain-based command-and-control infrastructure to deploy RAT malware, expanding the ChainVeil supply chain threat.
Hackers Backdoor Jscrambler npm Package with Infostealer Malware
A malicious version of the Jscrambler npm package containing infostealer malware was published and downloaded nearly 1,500 times, posing risks to developers and users of this client-side security tool.
Compromised jscrambler npm Release Installs Rust Infostealer
The jscrambler npm package version 8.14.0 was compromised to install a Rust-based infostealer via a preinstall hook, impacting Windows, macOS, and Linux environments.