#supplychainsecurity
LightNews LightNews
robertcfried.bsky.social
#Cybersecurity #Cyberattacks #RefrigerationSecurity #IoTSecurity #OperationalTechnology #CriticalInfrastructure #ColdChainSecurity #FoodSecurity #SupplyChainSecurity #MilitaryLogistics #Pentagon #CyberInvestigation #France #NATO #CyberDefense
November 1, 2026 at 7:57 PM
pkgradar.bsky.social
📈 Week in review: 85 malicious packages caught, npm most-targeted, a median 2 days ahead of their public advisories.

#malware #supplychainsecurity #opensource
This week in supply-chain malware
PkgRadar's live view of malicious-package activity across nine ecosystems.
pkgradar.com
November 3, 2026 at 10:55 AM
pkgradar.bsky.social
📊 In the last day: 1 malicious package caught across rubygems, ahead of the public advisory. We were first on 50%.

#malware #supplychainsecurity #opensource
Flagged-first coverage
1 malicious packages flagged across rubygems, before their public advisories.
pkgradar.com
November 2, 2026 at 8:57 AM
pkgradar.bsky.social
📊 In the last day: 1 malicious package caught across pypi, ahead of the public advisory. We were first on 25%.

#malware #supplychainsecurity #opensource
Flagged-first coverage
1 malicious packages flagged across pypi, before their public advisories.
pkgradar.com
October 31, 2026 at 8:56 AM
packagist.com
Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. blog.packagist.com/composer-2-... #php #phpc #composerphp #supplychainsecurity
October 29, 2026 at 10:18 AM
cyberlensai.bsky.social
AI agent skills deserve code-review energy.

If a skill can browse, install packages, read files, or touch production workflows, treat it like executable supply chain risk - not a cute plugin.

Scan before you trust. #AIAgents #SupplyChainSecurity
October 30, 2026 at 5:19 PM
theminingnews.bsky.social
🚀 Rare Earth Processing Bottlenecks Threaten Western Supply Chain Ambitions
🔎 Read the full update:
➡️https://theminingnews.com/rare-earth-processing-bottlenecks-threaten-western-supply-chain-ambitions-2/
#RareEarth#RareEarthsh#RareEarthProcessingM#CriticalMineralsa#SupplyChainSecuritya#WesternManuf
November 1, 2026 at 4:53 PM
pkgradar.bsky.social
⏱ Caught early: npm levvleys@2.0.6 was on our radar 76 days before MAL-2026-17397 went public.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm levvleys@2.0.6
PkgRadar flagged this 76 days before MAL-2026-17397 was published. See the dated receipt and static evidence.
pkgradar.com
November 3, 2026 at 10:55 AM
pkgradar.bsky.social
⏱ Before the advisory: our scan flagged npm @mamans2973/maman@1.0.1 2 days ahead of MAL-2026-18431.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm @mamans2973/maman@1.0.1
PkgRadar flagged this 2 days before MAL-2026-18431 was published. See the dated receipt and static evidence.
pkgradar.com
November 1, 2026 at 8:57 AM
robertcfried.bsky.social
#CargoTheft #GPSSpoofing #DataCenterSecurity #Cybercrime #HighwayRobbery #SupplyChainSecurity #FreightFraud #OrganizedCrime #StolenTech #DataCenters #AIInfrastructure #TruckingSecurity #LogisticsSecurity #Cybersecurity #TechTheft
October 27, 2026 at 4:13 AM
pkgradar.bsky.social
⏱ Caught early: npm @axon-web/icons@99.0.0 was on our radar 5 days before MAL-2026-18433 went public.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm @axon-web/icons@99.0.0
PkgRadar flagged this 5 days before MAL-2026-18433 was published. See the dated receipt and static evidence.
pkgradar.com
November 2, 2026 at 8:58 AM
thedailytechfeed.com
GitHub’s npm Firewall blocks malicious npm installs with policy checks and cooldowns. #GitHub #npm #SupplyChainSecurity #DevSecOps #MalwarePrevention #AI #CI/CD thedailytechfeed.com/github-debut...
October 29, 2026 at 11:03 AM
pkgradar.bsky.social
📊 In the last day: 3 malicious packages caught across npm and pypi, ahead of the public advisory. We were first on 100%.

#malware #supplychainsecurity #opensource
Flagged-first coverage
3 malicious packages flagged across npm and pypi, before their public advisories.
pkgradar.com
October 28, 2026 at 8:55 AM
pkgradar.bsky.social
⏱ We flagged npm noxleyss@1.0.0 76 days before the public advisory landed (MAL-2026-17402).

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm noxleyss@1.0.0
PkgRadar flagged this 76 days before MAL-2026-17402 was published. See the dated receipt and static evidence.
pkgradar.com
October 30, 2026 at 8:55 AM
miningir.bsky.social
🚀 Rare Earth Processing Bottlenecks Threaten Western Supply Chain Ambitions
🔎 Read the full update:
➡️https://miningir.com/rare-earth-processing-bottlenecks-threaten-western-supply-chain-ambitions-2/

#RareEarths #CriticalMinerals #SupplyChainSecurity #WesternManufacturing #DomesticProcess
Rare Earth Processing Bottlenecks Threaten Western Supply Chain Ambitions - MiningIR
Rare earth processing constraints have emerged as one of the most significant vulnerabilities in Western efforts to build sovereign critical minerals supply
miningir.com
November 1, 2026 at 3:02 PM
anchore.com
Zero-day investigations rely on historical SBOM data.

Will you be ready when threats require next-gen SBOMs you never collected?

Anchore Enterprise 5.20 = SPDX 3.0 storage now.

➡️ https://anchore.com/blog/anchore-enterprise-is-now-spdx-3-ready/

#SBOM #SupplyChainSecurity
Anchore Enterprise is now SPDX 3 Ready | Anchore
SPDX 3 is here! Explore how Anchore Enterprise is leading the way in supporting the latest SBOM technology advancements.
anchore.com
October 31, 2026 at 3:08 PM
securityonline.bsky.social
Google dismantled the Videostrong XCPE botnet infecting 1.3M set-top boxes. The XCPE botnet sold residential proxy access to cybercrime affiliates.

#XCPEBotnet #AndroidSecurity #GoogleThreatIntelligence #IoTBotnet #SupplyChainSecurity #Malware
Google Disrupts Videostrong XCPE Botnet on Android TV
At a Glance Malware Family XCPE botnet (x.cpe / com.oemservice firmware backdoor and com.abc.nexus loader) Threat Actor Confirmed attribution to hardware manufacturer Videostrong Technology Co. Target / Victims Over 1.3 million Android TV set-top boxes, telehealth devices, karaoke machines, and digital signs; severed access to over 10 million affiliate bots Delivery Vector
securityonline.info
November 2, 2026 at 3:34 PM
pkgradar.bsky.social
📈 This week pypi was the most-targeted ecosystem we saw: 96 malicious packages caught, a median 0 days before their public advisories.

#malware #supplychainsecurity #opensource
This week in supply-chain malware
PkgRadar's live view of malicious-package activity across nine ecosystems.
pkgradar.com
October 27, 2026 at 8:54 AM
helpnetsecurity.com
GitHub’s npm package firewall can block brand-new versions before they install

📖 Read more: www.helpnetsecurity.com/2026/10/28/g...

#cybersecurity #cybersecuritynews #NPM #appsec #supplychainsecurity @github.com
GitHub's npm package firewall can block brand-new versions before they install - Help Net Security
GitHub package firewall checks npm packages against enterprise policy before install, blocking known malware and brand-new versions.
www.helpnetsecurity.com
October 29, 2026 at 8:24 AM
shandow.bsky.social
🚀 Platform Engineering Monthly #35 is out!

🐛 PHP2Shell exploited before the patch shipped
🏛️ 32 UK government services went dark for patching
🦊 GitLab RCE spans 12 years of releases

📖 Read & subscribe → pemonthly.com/p/php2shell-...

#PlatformEngineering #DevSecOps #SupplyChainSecurity
October 27, 2026 at 2:03 PM
raphinou.bsky.social
The CfP for the #security #devroom @fosdem.org was published: github.com/security-dev... . I will propose @asfaload.bsky.social as a talk, as it fits the #supplychainsecurity suggestion.
github.com
October 26, 2026 at 10:00 AM
abu-bakar05.bsky.social
Verifying dependency checksums, signing software artifacts, and mitigating third-party supply chain risks inside automated deployment pipelines. Galgotias University teaches developers to safeguard software end-to-end! 🔒🛡️
#GalgotiasUniversity #DevSecOps #SupplyChainSecurity #CleanCode
October 26, 2026 at 5:10 PM
pkgradar.bsky.social
⏱ Caught early: npm @apexacc/cli@1.5.121 was on our radar 36 days before MAL-2026-17924 went public.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm @apexacc/cli@1.5.121
PkgRadar flagged this 36 days before MAL-2026-17924 was published. See the dated receipt and static evidence.
pkgradar.com
October 27, 2026 at 8:53 AM
securityonline.bsky.social
Cursor removed a malicious Claude Code extension backdoor. Learn how the Cursor Claude Code extension backdoor planted SSH keys on up to 5,000 developer PCs.

#ClaudeCode #Cursor #SSHBackdoor #SupplyChainSecurity #Cybersecurity #InfoSec
Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace
TL;DR On October 29, 2026, AI coding editor Cursor removed a tampered extension that exposed up to 5,000 developers. Specifically, attackers slipped a Claude Code extension backdoor into version 2.1.313 of the Anthropic.claude-code package. Furthermore, this Cursor Claude Code extension backdoor attempted to install a persistent reverse SSH tunnel on macOS and Windows workstations. Delivery and Attribution The malicious package appeared on the Cursor VS Code extension Marketplace and the Open VSX registry early Thursday morning.
securityonline.info
October 30, 2026 at 9:30 AM
securityonline.bsky.social
Cursor removed a malicious Claude Code extension backdoor. Learn how the Cursor Claude Code extension backdoor planted SSH keys on up to 5,000 developer PCs.

#ClaudeCode #Cursor #SSHBackdoor #SupplyChainSecurity #Cybersecurity #InfoSec
Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace
TL;DR On October 29, 2026, AI coding editor Cursor removed a tampered extension that exposed up to 5,000 developers. Specifically, attackers slipped a Claude Code extension backdoor into version 2.1.313 of the Anthropic.claude-code package. Furthermore, this Cursor Claude Code extension backdoor attempted to install a persistent reverse SSH tunnel on macOS and Windows workstations. Delivery and Attribution The malicious package appeared on the Cursor VS Code extension Marketplace and the Open VSX registry early Thursday morning.
securityonline.info
October 30, 2026 at 9:30 AM