Crime Stoppers Breach: Who Protects Canadians' Privacy?

Compromised LiteLLM 1.107.0 packages run a credential stealer at Python startup and can fetch and execute additional code.

The MALFEX-linked npm package imgdecode uses a Windows DLL to fetch and decrypt a GitHub payload before injecting it into dllhost.exe.

GitHub now expires unvalidated npm trusted publisher bindings after 48 hours to limit package hijacks through reclaimed repository names.

A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.

The Rust crate arrayref 0.3.10 is compromised: it pulls in the typosquatted proc-macro1 1.0.107, whose build script downloads and runs a remote binary at build time. Full technical analysis: timeline,...

See how the ActiveState Platform can be used to generate ...

Watch this webinar to learn 3 steps to secure your softwa...

A Software Bill of Materials (SBOM) is a comprehensive inventory that details every ingredient that goes into building software. In modern software

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a new web-based tool that it says will beef up cybersecurity...

It's a losing proposition to generate SBOMs just to land a federal contract or meet an industry requirement, without analyzing and acting ...

Wiz Red Agent finds its way into Snowflake's internal Jira through a flaw in a GitHub Copilot–Assisted PR.

On July 11, 2026, an attacker used a stolen npm token to publish malicious versions of the Jscrambler package. We caught it within seconds.

On July 14, 2026 at 07:10 UTC, three packages in the AsyncAPI generator monorepo (@asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, and @asyncapi/generator-components@0.7.1) were published to npm carrying an obfuscated dropper that fires the moment the library is loaded, not on install. The packages were published through the project's own legitimate GitHub Actions release workflow and carry valid npm OIDC provenance attestations, because the attacker didn't steal an npm token: they gained push access to the repository's next branch and let the project's real CI/CD pipeline do the publishing for them.

A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.

Researchers found hijacked npm packages and 16 Go packages using fake font files and VS Code tasks to deploy a Python infostealer.

A new self-replicating supply-chain attack dubbed "IronWorm" has been discovered in the wild. Built in Rust and hiding behind an eBPF rootkit

Checkmarx warned over the weekend that a rogue version of its Jenkins Application Security Testing (AST) plugin had been published on the Jenkins Marketplace.

On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory — producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now.

Malicious Lightning 2.6.2/2.6.3 released April 30 enable credential theft via hidden payload, leading to PyPI quarantine and forced remediation.

Multiple official SAP npm packages were compromised in what is believed to be a TeamPCP supply-chain attack to steal credentials and authentication tokens from developers' systems.