GitHub to Disable npm Install Scripts by Default to Combat Supply Chain Attacks
GitHub has announced significant security changes for npm version 12, set to release next month, aimed at mitigating software supply chain attacks.…
Tag: Supply Chain Security
2026 Cybersecurity Stars Awards Recognize Excellence Across 95 Categories
The 2026 Cybersecurity Stars Awards winners have been announced, celebrating innovation, impact, and technical excellence in cybersecurity across 95 subcategories. The awards…
2026 Cybersecurity Stars Awards Winners Announced Across 95 Categories
The 2026 Cybersecurity Stars Awards winners have been announced across 95 subcategories, recognizing excellence in cybersecurity innovation, impact, and technical excellence. The…
Sonatype: Software Supply Chain Security Company
Sonatype identified and tracked the Atomic Arch campaign as Sonatype-2026-003775. They provide tools for software supply chain security.
StepSecurity: Highlighted High-Value Target Nature of Mastra Ecosystem
StepSecurity, a security company focused on CI/CD and supply chain security, noted that Mastra packages are installed in environments with sensitive credentials,…
Endor Labs: Security Firm Involved in Detecting Mastra npm Attack
Endor Labs was one of the security firms that discovered the Mastra npm package compromise. The company specializes in software supply chain…
Malicious JetBrains Plugins Steal AI API Keys; Chrome Extensions Capture Chatbot Chats
Cybersecurity researchers have uncovered a coordinated malware campaign on the JetBrains Marketplace involving 15 malicious plugins that exfiltrate AI provider API keys.…
Aikido Security Discovers Malicious JetBrains Plugins Stealing AI API Keys
Aikido Security is a cybersecurity company that identified a coordinated malware campaign on the JetBrains Marketplace involving 15 malicious plugins that exfiltrate…
JetBrains Marketplace Targeted by Malicious Plugin Campaign
JetBrains is a software development company whose marketplace was targeted by a campaign publishing 15 malicious plugins that steal AI API keys.…
CodeGPT AI Assistant JetBrains Plugin Steals AI API Keys
CodeGPT AI Assistant is a malicious JetBrains plugin with over 25,000 downloads that poses as an AI coding assistant but exfiltrates AI…