Category
Supply Chain
- 12
- stories
- JUN 17
- latest
Mastra AI Hit By npm Compromise
The unknown threat actor gained unauthorized access to legitimate npm accounts, allowing them to inject malicious dependencies into widely used packages.
DENNIS FISHER · JUN 17 · 2 min
All Supply Chain
GitHub Confirms Internal Breach
The company said it is still working through the intrusion but does not believe any customer repositories or data was affected at this point.
Dennis Fisher · 3 min
Data Shows Thousands of Automatic Tank Gauges Exposed Across the US
As of May 2026, over 6,502 ATG services running on 6,057 unique hosts were found to be reachable on the public internet across more than 65 countries.
Dennis Fisher · 2 min
Ongoing Supply Chain Attack Expands to PyPi
Researchers have linked the compromise to the “Mini Shai-Hulud” campaign, which has been ongoing for several weeks and is associated with TeamPCP.
Dennis Fisher · 3 min
Attackers Target Checkmarx KICS Ecosystem
Yet another supply chain attack has hit the open source ecosystem, this time impacting the Checkmarx KICS Docker Hub repository.
Lindsey O'Donnell-Welch · 3 min
Supply Chain Attack Hits Axios NPM Packages
Axios is a dependency in nearly 80% of all cloud and code environments and sees approximately 100 million downloads per week.
Dennis Fisher · 4 min
TeamPCP’s Supply Chain Attack Spree Continues
TeamPCP’s latest victim is the Telnyx Python SDK on PyPl, coming after a wave of supply chain hits on Aqua Trivy, Checkmarx KICS/OpenVSX, and LiteLLM.
Lindsey O'Donnell-Welch · 3 min
Broad Exploit Activity Targets React2Shell Flaw
The vulnerability was disclosed publicly on Dec. 3 and researchers and threat intelligence teams immediately began seeing opportunistic and targeted exploitation attempts.
Dennis Fisher · 3 min
New Shai Hulud NPM Worm Emerges
Researchers from Wiz are currently tracking more than 25,000 affected repositories across approximately 350 unique users.
Dennis Fisher · 2 minF5: Attacker Accessed BIG-IP Source Code, Bug Data
The company discovered the intrusion in August but did not say when the attackers first gained access to F5’s systems or how long they had access.
Dennis Fisher · 2 min