4 casos · pág. 1/1
Wiz describes a supply chain detection pipeline that analyzes new npm package versions at publication, so malicious releases can be flagged before a CVE or advisory exists. Wiz Research says notable supply chain attacks rose from about 10% of significant incidents in H2 2025 to 25% in H1 2026. The article cites two compromises: the Axios …
A malicious version 0.7.4 of the mrmustard photonic quantum computing library (Xanadu) was published to PyPI on July 23, 2026, after the account of the project's lead maintainer (ziofil, Filippo Miatto) was compromised. Importing the package reads SSH private keys, AWS credentials and the Kubernetes config, then sends them to an attacker-…
On August 20, 2026, a compromised release of the Rust crate arrayref (0.3.10, about 245 million all-time downloads) appeared on crates.io. It added a dependency on the typosquatted crate proc-macro1 1.0.107, whose build script downloads and runs a remote binary at compile time. The maintainer account droundy appears to have been compromis…
On September 23, 2026, an attacker published malicious versions of @memtensor/memos-cloud-openclaw-plugin (npm, versions 0.1.21, 0.1.23 and 0.1.25 per the article) and the MemoryOS Python library (PyPI, 2.0.34). Both carry the same Go implant, sckit, which harvests credentials from the home directory, exfiltrates them to servers under sky…
