Newsroom

Bloomberg

Hackers Compromise Axios, Widely Used Software Development Tool

March 31, 2026

Tech Crunch

North Korean hackers blamed for hijacking popular Axios open source project to spread malware

March 31, 2026

The Register

GitHub nukes 70+ Microsoft repos breaks CI/CD pipelines following suspected worm infections

June 8, 2026

Bleeping Computet

AsyncAPI npm packages infected with credential-stealing malware

July 15, 2026

Bleeping Computer

Injective SDK on npm infected with cryptocurrency wallet stealer

July 9, 2026

The Hacker News

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

July 15, 2026

The Hacker News

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

July 10, 2027

The Hacker News

Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

June 26, 2026

The Hacker News

Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer

June 9, 2026

The Hacker News

145 Mastra npm Packages Compromised via Hijacked Contributor Account

June 17, 2026

Dark Reading

Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories

June 10, 2026

Security Week

Over 100 NPM PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks

June 9, 2026

The Register

GitHub nukes 70+ Microsoft repos, breaks CI/CD pipelines, following suspected worm infections

June 8, 2026

The Hacker News

Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack

June 6, 2026

The Hacker News

IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks

June 5, 2026

Tech Times

Red Hat npm Packages Compromised 57 More Follow: Signed Attestations Cannot Block Pipeline Hijack

June 5, 2026

Cyber Security News

binding.gyp Supply Chain Attack Compromises Dozens of npm Packages Across Maintainer Accounts

June 4, 2026

The Hacker News

Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm

June 1, 2026

Bleeping Computer

Shai Hulud attack ships signed malicious TanStack, Mistral npm packages

May 12, 2026

Venture Beat

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

May 20, 2026

The Hacker News

Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer

May 19, 2026

The Hacker News

Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials

May 18, 2026

The Hacker News

Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages

May 12, 2026

Venture Beat

Protect your enterprise now from the Shai-Hulud worm and npm vulnerability in 6 actionable steps

May 12, 2026

PyPI package with 1.1M monthly downloads hacked to push infostealer

March 27, 2026

The Hacker News

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

March 23, 2026

BleepingComputer

New npm supply-chain attack self-spreads to steal auth tokens

March 22, 2026

Venture Beat

Hackers slipped a trojan into axios, the code library behind most of the internet

April 1, 2026

Dark Reading

Axios NPM Package Compromised in Precision Attack

April 1, 2026

SECURITYWEEK

Axios NPM Package Breached in North Korean Supply Chain Attack

April 1, 2026

The Hacker News

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

March 31, 2026

CSO

Attackers trojanize Axios HTTP library in highest-impact npm supply chain attack

March 31, 2026

The Register

Top npm package backdoored to drop dirty RAT on dev machines

March 31, 2026

The Record

Google links axios supply chain attack to North Korean group

April 1, 2026

BleepingComputer

Hackers compromise Axios npm package to drop cross-platform malware

March 31, 2026

Bleeping Computer

Popular LiteLLM PyPI package backdoored to steal credentials, auth tokens

March 24, 2026

Bleeping Computer

New Checkmarx supply-chain breach affects KICS analysis tool

April 23, 2026

The Hacker News

Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens

April 22, 2026

The Hacker News

GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos

March 16, 2026

The Hacker News

Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens

April 22, 2026

The Hacker News

Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets

March 11, 2026

The Hacker News

Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems

February 26, 2026

Dark Reading

Catching Up with Varun Sharma, CEO, StepSecurity and Ashish Kurmi, CTO, StepSecurity

September 19, 2025

The Register

GitHub supply chain attack spills secrets from 23,000 projects

March 17, 2025

BleepingComputer

Supply chain attack on popular GitHub Action exposes CI/CD secrets

March 17, 2025

SECURITYWEEK

Popular GitHub Action Targeted in Supply Chain Attack

March 17, 2025

The Hacker News

GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories

March 17, 2025

Info Security Magazine

Tj-actions Supply Chain Attack Exposes 23,000 Organizations

March 17, 2025

The Hacker News

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

March 27, 2026

SC Media

Namastex npm packages compromised in ‘CanisterWorm’ supply chain attack

April 23, 2026

The Register

AI coding assistant Cline compromised to create more OpenClaw chaos

February 26, 2026

CSO

NPM ecosystem hit with two new supply chain compromises

July 15, 2026

BankInfo Security

Mastra AI Framework Poisoned in npm Supply-Chain Attack

June 17, 2026

Security Week

Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks

June 9, 2026

Security Week

Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages

June 16, 2026

CSO

Meet Hades: The malware that lies to AI security agents

June 9, 2026

CSO

Meet Hades: The malware that lies to AI security agents

June 9, 2026

Bank Info Security

Miasma Worm Hits Microsoft's AI Coding Ecosystem

June 8, 2026

Help Net Security

Red Hat npm packages compromised in new Mini Shai-Hulud malware wave

June 2, 2026

Cybersecurity Dive

CISA urges security teams to check for software development compromises

May 29, 2026

America's Cyber Defense Agency

Supply Chain Compromises Impact Nx Console and GitHub Repositories

May 28, 2026

Cybernews

Hundreds of open-source packages, including TanStack and Mistral, compromised in fresh wave of supply chain attacks

May 12, 2026

The Register

Cache-poisoning caper turns TanStack npm packages toxic

May 12, 2026

Infosecurity Magazine

Mini Shai-Hulud Hits TanStack npm Packages

April 12, 2026

Venture Beat

Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren't covering

May 18, 2026

Venture Beat

Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren't covering

May 18, 2026

Venture Beat

Valid certificates, stolen accounts: how attackers broke npm's last trust signal

May 22, 2026

Cybernews

Bitwarden CLI compromised in supply chain attack: hundreds of developers have installed malware

April 24, 2026

Gov Info Security

Backdooring of JavaScript Library Axios Tied to North Korea

April 10, 2026

Cybernews

Bitwarden CLI compromised in supply chain attack: hundreds of developers have installed malware

April 26, 2026

NextGov

North Korea-linked hackers suspected in Axios open-source hijack, Google analysts say

March 31, 2026

Venture Beat

Valid certificates, stolen accounts: how attackers broke npm's last trust signal

May 22, 2026

Malwarebytes

Axios supply chain attack chops away at npm trust

March 31, 2026

Help Net Security

Axios npm packages backdoored in supply chain attack

March 31, 2026

CyberScoop

Attack on axios software developer tool threatens widespread compromises

March 31, 2026

CyberNews

Critical supply chain attack hits LiteLLM, exposing AI developers

March 25, 2026

SC Media

GlassWorm campaign evolves: ForceMemo attack targets Python repos via stolen GitHub tokens

April 17, 2026

Security Week

ForceMemo: Python Repositories Compromised in GlassWorm Aftermath

March 16, 2026

InfoQ

AI-Powered Bot Compromises GitHub Actions Workflows Across Microsoft, DataDog, and CNCF Projects

March 11, 2026

Dark Reading

Xygeni GitHub Action Compromised Via Tag Poison

March 11, 2026

CyberNews

AI bot compromises five major GitHub repositories

March 3, 2026

Dark Reading

Supply Chain Attack Secretly Installs OpenClaw for Cline Users

February 20, 2026

The Cyber Express

New Shai-Hulud Attack Hits Nearly 500 npm Packages with 100+ Million Downloads

November 24, 2025

BleepingComputer

Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

November 24, 2025

CyberSecurityDive

CISA urges dependency checks following Shai-Hulud compromise

September 24, 2025

CISA

Widespread Supply Chain Compromise Impacting npm Ecosystem

September 23, 2025

KrebsonSecurity

Self-Replicating Worm Hits 180+ Software Packages

September 16, 2025

SECURITYWEEK

Hackers Target Popular Nx Build System in First AI-Weaponized Supply Chain Attack

August 28, 2025

The Hacker News

Malicious Nx Packages in 's1ngularity' Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

August 28, 2025

The Register

Nx NPM packages poisoned in AI-assisted supply chain attack

August 27, 2025

CISA

Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)

March 26, 2025

ITPro.

Organizations urged to act fast after GitHub Action supply chain attack

March 17, 2025

DevOps.com

GitHub Action Compromise Risks Data Leaks for 23,000 Repositories

March 17, 2025

BANK INFO SECURITY

Supply Chain Attack Targets GitHub Repositories and Secrets

March 17, 2025

CYBERSECURITY DIVE

Supply chain attack against GitHub Action triggers massive exposure of secrets

March 17, 2025

Tech Times

npm Supply Chain Attack: North Korea Backdoored 144 AI Packages in 88 Minutes

June 21, 2026

SC Media

AUR suspends new registrations as 1,500-plus malicious packages flood repository

June 17, 2026

GeekWire

Former Microsoft engineers raise $3M for cybersecurity startup StepSecurity

May 1, 2024

Rock Cyber Musings

Agent Supply Chain Attacks: Your Scanner Already Switched Sides

April 7, 2026

Phoenix Security

TeamPCP Supply Chain Attack: Trivy to Checkmarx to npm (2026)

March 24, 2026