#supply-chain-attack — Public Fediverse posts

14 Trojanized npm Packages Deploy AI-Powered Linux Backdoor

Researchers uncover 14 malicious npm packages that secretly install RedC2 4.0, an AI-assisted command-and-control framework designed to maintain stealthy access to Linux servers.

https://pulseofnations.lol/14-trojanized-npm/

#AiMalware #Backdoor #LinuxMalware #Npm #Redc2 #SoftwareSupplyChain #SupplyChainAttack

Kaspersky has identified a new malware family targeting Android car head units from DoFun. The malware abuses built-in OTA updaters to deploy ad fraud toolkits and proxy botnet infrastructure.

#SupplyChainAttack #ProxyBotnet #AutomotiveSecurity #AdFraud

https://cyberworldops.eu/en/malware-in-android-car-head-units-updates-become-a-channel-for-ad

14 trojanized npm packages deliver RedShell, a Linux beacon for RedC2 4.0, to any system that imports them. Auto-execution requires no hooks or user interaction, making transitive dependency inclusion a direct compromise vector. Supply chain hygiene remains critical. #RedC2 #SupplyChainAttack #NPM #LinuxMalware

https://cyberworldops.eu/en/npm-calendar-packages-conceal-redshell-the-linux-beacon-of-redc2-40

🦀 Atac de tip Supply Chain în ecosistemul Rust: Pachetul extrem de popular arrayref (245M+ descărcări) a fost compromis!Pe 20 august 2026, comunitatea de securitate și echipa Rust Security Response Team au intervenit de urgență pentru a elimina versiuni contaminate ale câtorva crate-uri extrem de populare. Contul de menținător al dezvoltarorului David Roundy a fost compromis, permițând atacatorilor să lanseze versiuni otrăvite de pachete în doar câteva zeci de minute. ✨ Detaliile atacului și modul de funcționare:📦 Pachetele afectate și modul de infectare:• Versiunile otrăvite publicate au fost arrayref 0.3.10, internment 0.8.7 și append-only-vec 0.1.9.• Atacatorii au injectat o dependență nouă numită proc-macro1, un pachet typosquat ce imita cunoscutul proc-macro2. ⚡ Execuție la nivel de compilare (Build-Time RCE):• Codul malițios era ascuns în fișierul build.rs al dependenței proc-macro1.
• Deoarece Cargo rulează fișierele build.rs automat în momentul compilării, simpla compilare a unui proiect care aducea indirect pachetele afectate executa malware-ul pe calculatorul dezvoltatorului, fără ca pachetul să fie apelat efectiv în cod. 🕵️ Payload și exfiltrare de date:• Scriptul descarca un binary specific sistemului de operare (Linux, macOS sau Windows).• Pachetul software funcționa ca un Infostealer, extras de date de sistem și de date de autentificare stocate în browsere bazate pe Chromium (Google Chrome, Brave, Microsoft Edge).• Analizele oferite de cercetători de securitate (cum ar fi Wiz) leagă infrastructura atacului de gruparea de hackeri nord-coreeni Sapphire Sleet. 🚨 Răspunsul rapid al echipei Rust:• Versiunile compromise au fost șterse complet de pe crates.io într-o fereastră de doar 86–107 minute de la publicare.• Contul afectat a fost securizat, iar pachetele au fost restaurate la versiunile sigure. 🔍 Ce trebuie să faci dacă lucrezi cu Rust?Verifică memoria cache locală din folderul Cargo pentru a te asigura că nu ai descărcat una dintre versiunile problematice:Bashfind ~/.cargo/registry/cache -type f \( -name 'arrayref-0.3.10.crate' -o -name 'internment-0.8.7.crate' -o -name 'append-only-vec-0.1.9.crate' -o -name 'proc-macro1-*.crate' \)
Un memento serios că atacurile de tip supply chain rămân o amenințare majoră, chiar și în ecosisteme cu accent pe siguranță precum Rust! 🚀#Rust #RustLang #SupplyChainAttack #CyberSecurity #InfoSec #Arrayref #Cargo #Linuxiac #TechNews #OpenSource

🦀 Atac de tip Supply Chain în ecosistemul Rust: Pachetul extrem de popular arrayref (245M+ descărcări) a fost compromis!Pe 20 august 2026, comunitatea de securitate și echipa Rust Security Response Team au intervenit de urgență pentru a elimina versiuni contaminate ale câtorva crate-uri extrem de populare. Contul de menținător al dezvoltarorului David Roundy a fost compromis, permițând atacatorilor să lanseze versiuni otrăvite de pachete în doar câteva zeci de minute. ✨ Detaliile atacului și modul de funcționare:📦 Pachetele afectate și modul de infectare:• Versiunile otrăvite publicate au fost arrayref 0.3.10, internment 0.8.7 și append-only-vec 0.1.9.• Atacatorii au injectat o dependență nouă numită proc-macro1, un pachet typosquat ce imita cunoscutul proc-macro2. ⚡ Execuție la nivel de compilare (Build-Time RCE):• Codul malițios era ascuns în fișierul build.rs al dependenței proc-macro1.
• Deoarece Cargo rulează fișierele build.rs automat în momentul compilării, simpla compilare a unui proiect care aducea indirect pachetele afectate executa malware-ul pe calculatorul dezvoltatorului, fără ca pachetul să fie apelat efectiv în cod. 🕵️ Payload și exfiltrare de date:• Scriptul descarca un binary specific sistemului de operare (Linux, macOS sau Windows).• Pachetul software funcționa ca un Infostealer, extras de date de sistem și de date de autentificare stocate în browsere bazate pe Chromium (Google Chrome, Brave, Microsoft Edge).• Analizele oferite de cercetători de securitate (cum ar fi Wiz) leagă infrastructura atacului de gruparea de hackeri nord-coreeni Sapphire Sleet. 🚨 Răspunsul rapid al echipei Rust:• Versiunile compromise au fost șterse complet de pe crates.io într-o fereastră de doar 86–107 minute de la publicare.• Contul afectat a fost securizat, iar pachetele au fost restaurate la versiunile sigure. 🔍 Ce trebuie să faci dacă lucrezi cu Rust?Verifică memoria cache locală din folderul Cargo pentru a te asigura că nu ai descărcat una dintre versiunile problematice:Bashfind ~/.cargo/registry/cache -type f \( -name 'arrayref-0.3.10.crate' -o -name 'internment-0.8.7.crate' -o -name 'append-only-vec-0.1.9.crate' -o -name 'proc-macro1-*.crate' \)
Un memento serios că atacurile de tip supply chain rămân o amenințare majoră, chiar și în ecosisteme cu accent pe siguranță precum Rust! 🚀#Rust #RustLang #SupplyChainAttack #CyberSecurity #InfoSec #Arrayref #Cargo #Linuxiac #TechNews #OpenSource

🦀 Atac de tip Supply Chain în ecosistemul Rust: Pachetul extrem de popular arrayref (245M+ descărcări) a fost compromis!Pe 20 august 2026, comunitatea de securitate și echipa Rust Security Response Team au intervenit de urgență pentru a elimina versiuni contaminate ale câtorva crate-uri extrem de populare. Contul de menținător al dezvoltarorului David Roundy a fost compromis, permițând atacatorilor să lanseze versiuni otrăvite de pachete în doar câteva zeci de minute. ✨ Detaliile atacului și modul de funcționare:📦 Pachetele afectate și modul de infectare:• Versiunile otrăvite publicate au fost arrayref 0.3.10, internment 0.8.7 și append-only-vec 0.1.9.• Atacatorii au injectat o dependență nouă numită proc-macro1, un pachet typosquat ce imita cunoscutul proc-macro2. ⚡ Execuție la nivel de compilare (Build-Time RCE):• Codul malițios era ascuns în fișierul build.rs al dependenței proc-macro1.
• Deoarece Cargo rulează fișierele build.rs automat în momentul compilării, simpla compilare a unui proiect care aducea indirect pachetele afectate executa malware-ul pe calculatorul dezvoltatorului, fără ca pachetul să fie apelat efectiv în cod. 🕵️ Payload și exfiltrare de date:• Scriptul descarca un binary specific sistemului de operare (Linux, macOS sau Windows).• Pachetul software funcționa ca un Infostealer, extras de date de sistem și de date de autentificare stocate în browsere bazate pe Chromium (Google Chrome, Brave, Microsoft Edge).• Analizele oferite de cercetători de securitate (cum ar fi Wiz) leagă infrastructura atacului de gruparea de hackeri nord-coreeni Sapphire Sleet. 🚨 Răspunsul rapid al echipei Rust:• Versiunile compromise au fost șterse complet de pe crates.io într-o fereastră de doar 86–107 minute de la publicare.• Contul afectat a fost securizat, iar pachetele au fost restaurate la versiunile sigure. 🔍 Ce trebuie să faci dacă lucrezi cu Rust?Verifică memoria cache locală din folderul Cargo pentru a te asigura că nu ai descărcat una dintre versiunile problematice:Bashfind ~/.cargo/registry/cache -type f \( -name 'arrayref-0.3.10.crate' -o -name 'internment-0.8.7.crate' -o -name 'append-only-vec-0.1.9.crate' -o -name 'proc-macro1-*.crate' \)
Un memento serios că atacurile de tip supply chain rămân o amenințare majoră, chiar și în ecosisteme cu accent pe siguranță precum Rust! 🚀#Rust #RustLang #SupplyChainAttack #CyberSecurity #InfoSec #Arrayref #Cargo #Linuxiac #TechNews #OpenSource

🦀 Atac de tip Supply Chain în ecosistemul Rust: Pachetul extrem de popular arrayref (245M+ descărcări) a fost compromis!Pe 20 august 2026, comunitatea de securitate și echipa Rust Security Response Team au intervenit de urgență pentru a elimina versiuni contaminate ale câtorva crate-uri extrem de populare. Contul de menținător al dezvoltarorului David Roundy a fost compromis, permițând atacatorilor să lanseze versiuni otrăvite de pachete în doar câteva zeci de minute. ✨ Detaliile atacului și modul de funcționare:📦 Pachetele afectate și modul de infectare:• Versiunile otrăvite publicate au fost arrayref 0.3.10, internment 0.8.7 și append-only-vec 0.1.9.• Atacatorii au injectat o dependență nouă numită proc-macro1, un pachet typosquat ce imita cunoscutul proc-macro2. ⚡ Execuție la nivel de compilare (Build-Time RCE):• Codul malițios era ascuns în fișierul build.rs al dependenței proc-macro1.
• Deoarece Cargo rulează fișierele build.rs automat în momentul compilării, simpla compilare a unui proiect care aducea indirect pachetele afectate executa malware-ul pe calculatorul dezvoltatorului, fără ca pachetul să fie apelat efectiv în cod. 🕵️ Payload și exfiltrare de date:• Scriptul descarca un binary specific sistemului de operare (Linux, macOS sau Windows).• Pachetul software funcționa ca un Infostealer, extras de date de sistem și de date de autentificare stocate în browsere bazate pe Chromium (Google Chrome, Brave, Microsoft Edge).• Analizele oferite de cercetători de securitate (cum ar fi Wiz) leagă infrastructura atacului de gruparea de hackeri nord-coreeni Sapphire Sleet. 🚨 Răspunsul rapid al echipei Rust:• Versiunile compromise au fost șterse complet de pe crates.io într-o fereastră de doar 86–107 minute de la publicare.• Contul afectat a fost securizat, iar pachetele au fost restaurate la versiunile sigure. 🔍 Ce trebuie să faci dacă lucrezi cu Rust?Verifică memoria cache locală din folderul Cargo pentru a te asigura că nu ai descărcat una dintre versiunile problematice:Bashfind ~/.cargo/registry/cache -type f \( -name 'arrayref-0.3.10.crate' -o -name 'internment-0.8.7.crate' -o -name 'append-only-vec-0.1.9.crate' -o -name 'proc-macro1-*.crate' \)
Un memento serios că atacurile de tip supply chain rămân o amenințare majoră, chiar și în ecosisteme cu accent pe siguranță precum Rust! 🚀#Rust #RustLang #SupplyChainAttack #CyberSecurity #InfoSec #Arrayref #Cargo #Linuxiac #TechNews #OpenSource

🦀 Atac de tip Supply Chain în ecosistemul Rust: Pachetul extrem de popular arrayref (245M+ descărcări) a fost compromis!Pe 20 august 2026, comunitatea de securitate și echipa Rust Security Response Team au intervenit de urgență pentru a elimina versiuni contaminate ale câtorva crate-uri extrem de populare. Contul de menținător al dezvoltarorului David Roundy a fost compromis, permițând atacatorilor să lanseze versiuni otrăvite de pachete în doar câteva zeci de minute. ✨ Detaliile atacului și modul de funcționare:📦 Pachetele afectate și modul de infectare:• Versiunile otrăvite publicate au fost arrayref 0.3.10, internment 0.8.7 și append-only-vec 0.1.9.• Atacatorii au injectat o dependență nouă numită proc-macro1, un pachet typosquat ce imita cunoscutul proc-macro2. ⚡ Execuție la nivel de compilare (Build-Time RCE):• Codul malițios era ascuns în fișierul build.rs al dependenței proc-macro1.
• Deoarece Cargo rulează fișierele build.rs automat în momentul compilării, simpla compilare a unui proiect care aducea indirect pachetele afectate executa malware-ul pe calculatorul dezvoltatorului, fără ca pachetul să fie apelat efectiv în cod. 🕵️ Payload și exfiltrare de date:• Scriptul descarca un binary specific sistemului de operare (Linux, macOS sau Windows).• Pachetul software funcționa ca un Infostealer, extras de date de sistem și de date de autentificare stocate în browsere bazate pe Chromium (Google Chrome, Brave, Microsoft Edge).• Analizele oferite de cercetători de securitate (cum ar fi Wiz) leagă infrastructura atacului de gruparea de hackeri nord-coreeni Sapphire Sleet. 🚨 Răspunsul rapid al echipei Rust:• Versiunile compromise au fost șterse complet de pe crates.io într-o fereastră de doar 86–107 minute de la publicare.• Contul afectat a fost securizat, iar pachetele au fost restaurate la versiunile sigure. 🔍 Ce trebuie să faci dacă lucrezi cu Rust?Verifică memoria cache locală din folderul Cargo pentru a te asigura că nu ai descărcat una dintre versiunile problematice:Bashfind ~/.cargo/registry/cache -type f \( -name 'arrayref-0.3.10.crate' -o -name 'internment-0.8.7.crate' -o -name 'append-only-vec-0.1.9.crate' -o -name 'proc-macro1-*.crate' \)
Un memento serios că atacurile de tip supply chain rămân o amenințare majoră, chiar și în ecosisteme cu accent pe siguranță precum Rust! 🚀#Rust #RustLang #SupplyChainAttack #CyberSecurity #InfoSec #Arrayref #Cargo #Linuxiac #TechNews #OpenSource

الاختراق المزدوج: قصة هجوم سلاسل التوريد المعقد على شركة 3CX

https://cybercases8.wordpress.com/2026/08/21/%d8%a7%d9%84%d8%a7%d8%ae%d8%aa%d8%b1%d8%a7%d9%82-%d8%a7%d9%84%d9%85%d8%b2%d8%af%d9%88%d8%ac-%d9%82%d8%b5%d8%a9-%d9%87%d8%ac%d9%88%d9%85-%d8%b3%d9%84%d8%a7%d8%b3%d9%84-%d8%a7%d9%84%d8%aa%d9%88%d8%b1/

الاختراق المزدوج: قصة هجوم سلاسل التوريد المعقد على شركة 3CX

https://cybercases8.wordpress.com/2026/08/21/%d8%a7%d9%84%d8%a7%d8%ae%d8%aa%d8%b1%d8%a7%d9%82-%d8%a7%d9%84%d9%85%d8%b2%d8%af%d9%88%d8%ac-%d9%82%d8%b5%d8%a9-%d9%87%d8%ac%d9%88%d9%85-%d8%b3%d9%84%d8%a7%d8%b3%d9%84-%d8%a7%d9%84%d8%aa%d9%88%d8%b1/

A Rust supply chain attack poisoned arrayref and two other crates to run malware at build time. Wiz ties the infrastructure to DPRK campaigns.

#RustLang #SupplyChainAttack #arrayref #DPRK #DevSecOps #InfoSec #Cybersecurity

https://securityonline.info/arrayref-rust-supply-chain-attack/?utm_source=mastodon&utm_medium=jetpack_social

A Rust supply chain attack poisoned arrayref and two other crates to run malware at build time. Wiz ties the infrastructure to DPRK campaigns.

#RustLang #SupplyChainAttack #arrayref #DPRK #DevSecOps #InfoSec #Cybersecurity

https://securityonline.info/arrayref-rust-supply-chain-attack/?utm_source=mastodon&utm_medium=jetpack_social

If you are developing in #Rustlang then you should check this post: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

#cybersecurity #infosec #supplychain #supplychainattack

If you are developing in #Rustlang then you should check this post: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

#cybersecurity #infosec #supplychain #supplychainattack

If you are developing in #Rustlang then you should check this post: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

#cybersecurity #infosec #supplychain #supplychainattack

If you are developing in #Rustlang then you should check this post: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

#cybersecurity #infosec #supplychain #supplychainattack

If you are developing in #Rustlang then you should check this post: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

#cybersecurity #infosec #supplychain #supplychainattack

LiteLLM Supply-Chain Attack Hits 2,500+ Orgs

TeamPCP compromised the popular AI gateway library, exposing GitHub tokens, cloud keys and API secrets across Microsoft, NVIDIA, IBM and hundreds more

https://pulseofnations.lol/litellm-supply-chain-2/

#AiSecurity #CredentialTheft #Cybersecurity #Litellm #Pypi #Sandclock #SupplyChainAttack #Teampcp

LiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most Affected

LiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most Affected Pierluigi Paganini August 17, 2026 The SANDCLOCK…
#NewsBeep #News #Healthcare #AU #Australia #Cybercrime #hacking #hackingnews #Health #informationsecuritynews #ITInformationSecurity #LiteLLM #Malware #PierluigiPaganini #SANDCLOCKbackdoor #SecurityAffairs #SecurityNews #supplychainattack #TeamPCP
https://www.newsbeep.com/au/859591/

LiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most Affected

LiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most Affected Pierluigi Paganini August 17, 2026 The SANDCLOCK…
#NewsBeep #News #Healthcare #AU #Australia #Cybercrime #hacking #hackingnews #Health #informationsecuritynews #ITInformationSecurity #LiteLLM #Malware #PierluigiPaganini #SANDCLOCKbackdoor #SecurityAffairs #SecurityNews #supplychainattack #TeamPCP
https://www.newsbeep.com/au/859591/

GEEKOM's official site served backdoored AMD mini PC drivers since December 2024 via a compromised legacy support page still indexed by Google.

#GEEKOM #MiniPC #Backdoor #DriverMalware #SupplyChainAttack

https://securityonline.info/geekom-driver-backdoor-malware/?utm_source=mastodon&utm_medium=jetpack_social

GEEKOM's official site served backdoored AMD mini PC drivers since December 2024 via a compromised legacy support page still indexed by Google.

#GEEKOM #MiniPC #Backdoor #DriverMalware #SupplyChainAttack

https://securityonline.info/geekom-driver-backdoor-malware/?utm_source=mastodon&utm_medium=jetpack_social

https://www.europesays.com/ie/643174/ LiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most Affected #Cybercrime #Éire #Hacking #HackingNews #Health #HealthCare #Healthcare #IE #InformationSecurityNews #Ireland #ITInformationSecurity #LiteLLM #Malware #PierluigiPaganini #SANDCLOCKBackdoor #SecurityAffairs #SecurityNews #SupplyChainAttack #TeamPCP

Kaspersky: APAC cyber threats remain high, 75 million attacks blocked in six months #apac #apt #cyberattack #cybersecurity #digitallife #escan #great #kaspersky #kasperskygreat #news #notepad #supplychainattack

https://soyacincau.com/2026/08/18/kaspersky-apac-75-million-attacks-blocked-h1-2026/

Kaspersky: APAC cyber threats remain high, 75 million attacks blocked in six months #apac #apt #cyberattack #cybersecurity #digitallife #escan #great #kaspersky #kasperskygreat #news #notepad #supplychainattack

https://soyacincau.com/2026/08/18/kaspersky-apac-75-million-attacks-blocked-h1-2026/

Kaspersky: APAC cyber threats remain high, 75 million attacks blocked in six months #apac #apt #cyberattack #cybersecurity #digitallife #escan #great #kaspersky #kasperskygreat #news #notepad #supplychainattack

https://soyacincau.com/2026/08/18/kaspersky-apac-75-million-attacks-blocked-h1-2026/

Kaspersky: APAC cyber threats remain high, 75 million attacks blocked in six months #apac #apt #cyberattack #cybersecurity #digitallife #escan #great #kaspersky #kasperskygreat #news #notepad #supplychainattack

https://soyacincau.com/2026/08/18/kaspersky-apac-75-million-attacks-blocked-h1-2026/

A supply chain attack on the open source project LiteLLM distributed a backdoor called SANDCLOCK via PyPI, exposing credentials of thousands of organizations in tech, finance, and healthcare. Attributed to TeamPCP through compromised maintainer accounts. Many victims may still be unaware.

#SupplyChainAttack #LiteLLM #InfoSec #ThreatActor

https://cyberworldops.eu/en/litellm-supply-chain-attack-exposes-credentials-belonging-to-thousands

A supply chain attack on the open source project LiteLLM distributed a backdoor called SANDCLOCK via PyPI, exposing credentials of thousands of organizations in tech, finance, and healthcare. Attributed to TeamPCP through compromised maintainer accounts. Many victims may still be unaware.

#SupplyChainAttack #LiteLLM #InfoSec #ThreatActor

https://cyberworldops.eu/en/litellm-supply-chain-attack-exposes-credentials-belonging-to-thousands

📰 Clop Group Claims Massive Data Heist from Shell, Philips, GE via PTC Flaw

Clop ransomware group claims massive data theft from Shell, Philips, GE, and 40+ others by exploiting a critical PTC Windchill vulnerability (CVE-2026-12569). #Clop #Ransomware #SupplyChainAttack

🔗 https://cyber.netsecops.io/articles/clop-ransomware-exploits-ptc-vulnerability-hits-shell-philips-ge/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Four suspects arrested in Brazil and three identified in Europe for exploiting a software vulnerability at a payment service provider. The attackers compromised interbank transfer infrastructure, generating roughly 30 million euros in losses across just four days in November 2023.

#BankFraud #PaymentSecurity #SupplyChainAttack #CyberCrime

https://cyberworldops.eu/en/bank-payment-attacks-four-arrests-in-brazil-over-30-million-fraud

Four suspects arrested in Brazil and three identified in Europe for exploiting a software vulnerability at a payment service provider. The attackers compromised interbank transfer infrastructure, generating roughly 30 million euros in losses across just four days in November 2023.

#BankFraud #PaymentSecurity #SupplyChainAttack #CyberCrime

https://cyberworldops.eu/en/bank-payment-attacks-four-arrests-in-brazil-over-30-million-fraud

Reward: You've received the Cursed Artifact — 434,000 Compromised Pipelines. It has no sell value. It does have consequences.

#SupplyChainAttack #CyberSecurity #AIInfrastructure #TeamPCP #CICD #CriticalHitTaken (3/3)

Reward: You've received the Cursed Artifact — 434,000 Compromised Pipelines. It has no sell value. It does have consequences.

#SupplyChainAttack #CyberSecurity #AIInfrastructure #TeamPCP #CICD #CriticalHitTaken (3/3)

Reward: You've received the Cursed Artifact — 434,000 Compromised Pipelines. It has no sell value. It does have consequences.

#SupplyChainAttack #CyberSecurity #AIInfrastructure #TeamPCP #CICD #CriticalHitTaken (3/3)

Reward: You've unlocked the Compliance Violation Certificate, suitable for framing.

#SupplyChainAttack #CyberSecurity #CredentialsLeaked #CICD #InfoSec #AchievementUnlocked (4/4)

Reward: You've unlocked the Compliance Violation Certificate, suitable for framing.

#SupplyChainAttack #CyberSecurity #CredentialsLeaked #CICD #InfoSec #AchievementUnlocked (4/4)

Reward: You've unlocked the Compliance Violation Certificate, suitable for framing.

#SupplyChainAttack #CyberSecurity #CredentialsLeaked #CICD #InfoSec #AchievementUnlocked (4/4)

Hey everyone! Terabytes worth of #credentials, for more than 2500 massive Fortune 500 type orgs have been exposed in a supply-chain attack on #LiteLLM.

The breach was reported Tuesday and Wednesday by security firms #CloudSEK and #HudsonRock. (Links below) CloudSEK said it found cloud keys, repository tokens, #SSH keys, #Kubernetes secrets, package publishing credentials, environment variables, and AI provider #keys.

This, in the world of #infosec, is called A Bad Thing. The fact that some of the credentials are still live, is mind boggling.

#ai #security #SupplyChainAttack #hack

https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines

Companies exposed: https://exposure.cloudsek.com/ai-supply-chain-incident

https://www.hudsonrock.com/blog/largest-ai-supply-chain-breach-of-2026-litellm-hack-impacts-thousands-of-global-enterprises-claim-your-ethical-disclosure

ArsTecnica overview: https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/

Hey everyone! Terabytes worth of #credentials, for more than 2500 massive Fortune 500 type orgs have been exposed in a supply-chain attack on #LiteLLM.

The breach was reported Tuesday and Wednesday by security firms #CloudSEK and #HudsonRock. (Links below) CloudSEK said it found cloud keys, repository tokens, #SSH keys, #Kubernetes secrets, package publishing credentials, environment variables, and AI provider #keys.

This, in the world of #infosec, is called A Bad Thing. The fact that some of the credentials are still live, is mind boggling.

#ai #security #SupplyChainAttack #hack

https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines

Companies exposed: https://exposure.cloudsek.com/ai-supply-chain-incident

https://www.hudsonrock.com/blog/largest-ai-supply-chain-breach-of-2026-litellm-hack-impacts-thousands-of-global-enterprises-claim-your-ethical-disclosure

ArsTecnica overview: https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/

Hey everyone! Terabytes worth of #credentials, for more than 2500 massive Fortune 500 type orgs have been exposed in a supply-chain attack on #LiteLLM.

The breach was reported Tuesday and Wednesday by security firms #CloudSEK and #HudsonRock. (Links below) CloudSEK said it found cloud keys, repository tokens, #SSH keys, #Kubernetes secrets, package publishing credentials, environment variables, and AI provider #keys.

This, in the world of #infosec, is called A Bad Thing. The fact that some of the credentials are still live, is mind boggling.

#ai #security #SupplyChainAttack #hack

https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines

Companies exposed: https://exposure.cloudsek.com/ai-supply-chain-incident

https://www.hudsonrock.com/blog/largest-ai-supply-chain-breach-of-2026-litellm-hack-impacts-thousands-of-global-enterprises-claim-your-ethical-disclosure

ArsTecnica overview: https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/

Hey everyone! Terabytes worth of #credentials, for more than 2500 massive Fortune 500 type orgs have been exposed in a supply-chain attack on #LiteLLM.

The breach was reported Tuesday and Wednesday by security firms #CloudSEK and #HudsonRock. (Links below) CloudSEK said it found cloud keys, repository tokens, #SSH keys, #Kubernetes secrets, package publishing credentials, environment variables, and AI provider #keys.

This, in the world of #infosec, is called A Bad Thing. The fact that some of the credentials are still live, is mind boggling.

#ai #security #SupplyChainAttack #hack

https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines

Companies exposed: https://exposure.cloudsek.com/ai-supply-chain-incident

https://www.hudsonrock.com/blog/largest-ai-supply-chain-breach-of-2026-litellm-hack-impacts-thousands-of-global-enterprises-claim-your-ethical-disclosure

ArsTecnica overview: https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/

Hey everyone! Terabytes worth of #credentials, for more than 2500 massive Fortune 500 type orgs have been exposed in a supply-chain attack on #LiteLLM.

The breach was reported Tuesday and Wednesday by security firms #CloudSEK and #HudsonRock. (Links below) CloudSEK said it found cloud keys, repository tokens, #SSH keys, #Kubernetes secrets, package publishing credentials, environment variables, and AI provider #keys.

This, in the world of #infosec, is called A Bad Thing. The fact that some of the credentials are still live, is mind boggling.

#ai #security #SupplyChainAttack #hack

https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines

Companies exposed: https://exposure.cloudsek.com/ai-supply-chain-incident

https://www.hudsonrock.com/blog/largest-ai-supply-chain-breach-of-2026-litellm-hack-impacts-thousands-of-global-enterprises-claim-your-ethical-disclosure

ArsTecnica overview: https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/

Rotate all CI/CD secrets, fully revoke stale automation tokens, and audit every pipeline variable that touches a cloud credential before it becomes someone else's loot drop.

Reward: INVENTORY PENALTY — Your cloud credentials have been auto-equipped by a stranger. Their build stats are now higher than yours.

#SupplyChainAttack #Credentials #CyberSecurity #CICD #CloudSecurity #SecretsExposed (3/3)

Rotate all CI/CD secrets, fully revoke stale automation tokens, and audit every pipeline variable that touches a cloud credential before it becomes someone else's loot drop.

Reward: INVENTORY PENALTY — Your cloud credentials have been auto-equipped by a stranger. Their build stats are now higher than yours.

#SupplyChainAttack #Credentials #CyberSecurity #CICD #CloudSecurity #SecretsExposed (3/3)

Rotate all CI/CD secrets, fully revoke stale automation tokens, and audit every pipeline variable that touches a cloud credential before it becomes someone else's loot drop.

Reward: INVENTORY PENALTY — Your cloud credentials have been auto-equipped by a stranger. Their build stats are now higher than yours.

#SupplyChainAttack #Credentials #CyberSecurity #CICD #CloudSecurity #SecretsExposed (3/3)

A supply-chain attack on LiteLLM has exposed sensitive credentials from 2,488 companies, highlighting the risks in software dependencies. Organizations should rotate compromised secrets and strengthen CI/CD security practices to prevent future incidents.

#CyberSecurity #SupplyChainAttack #LiteLLM #AI #DataBreach #CI/CD

https://thedailytechfeed.com/litellm-supply-chain-attack-exposes-thousands-of-corporate-secrets/

A #supplychainattack on the #opensource tool #LiteLLM exposed #terabytes of #credentials belonging to over 2,500 organisations, including Microsoft, Amazon, and Cisco. The attack, attributed to the group TeamPCP, exploited a #vulnerability in the #vulnerabilityscanner #Trivy and compromised versions of LiteLLM, KICS, and the Telnyx Python SDK. Security firms CloudSEK and Hudson Rock urge affected organisations to rotate credentials. https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/?eicker.news #tech #news #ainews

A #supplychainattack on the #opensource tool #LiteLLM exposed #terabytes of #credentials belonging to over 2,500 organisations, including Microsoft, Amazon, and Cisco. The attack, attributed to the group TeamPCP, exploited a #vulnerability in the #vulnerabilityscanner #Trivy and compromised versions of LiteLLM, KICS, and the Telnyx Python SDK. Security firms CloudSEK and Hudson Rock urge affected organisations to rotate credentials. https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/?eicker.news #tech #news #ainews

A #supplychainattack on the #opensource tool #LiteLLM exposed #terabytes of #credentials belonging to over 2,500 organisations, including Microsoft, Amazon, and Cisco. The attack, attributed to the group TeamPCP, exploited a #vulnerability in the #vulnerabilityscanner #Trivy and compromised versions of LiteLLM, KICS, and the Telnyx Python SDK. Security firms CloudSEK and Hudson Rock urge affected organisations to rotate credentials. https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/?eicker.news #tech #news #ainews

A #supplychainattack on the #opensource tool #LiteLLM exposed #terabytes of #credentials belonging to over 2,500 organisations, including Microsoft, Amazon, and Cisco. The attack, attributed to the group TeamPCP, exploited a #vulnerability in the #vulnerabilityscanner #Trivy and compromised versions of LiteLLM, KICS, and the Telnyx Python SDK. Security firms CloudSEK and Hudson Rock urge affected organisations to rotate credentials. https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/?eicker.news #tech #news #ainews

A #supplychainattack on the #opensource tool #LiteLLM exposed #terabytes of #credentials belonging to over 2,500 organisations, including Microsoft, Amazon, and Cisco. The attack, attributed to the group TeamPCP, exploited a #vulnerability in the #vulnerabilityscanner #Trivy and compromised versions of LiteLLM, KICS, and the Telnyx Python SDK. Security firms CloudSEK and Hudson Rock urge affected organisations to rotate credentials. https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/?eicker.news #tech #news #ainews

Payment and credential data survived, which we suppose is something. Supply chain delays rippled downstream like a stone dropped into a very expensive pond.

Operators: audit your data exposure scope now, notify affected customers, and review warehouse network segmentation before the next incident writes a longer eulogy.

Reward: You've received a Commemorative Cardboard Box — it ships in 6-8 weeks, supply chain pending.

#CyberSecurity #DataBreach #CevaLogistics #SupplyChainAttack (2/2)

Payment and credential data survived, which we suppose is something. Supply chain delays rippled downstream like a stone dropped into a very expensive pond.

Operators: audit your data exposure scope now, notify affected customers, and review warehouse network segmentation before the next incident writes a longer eulogy.

Reward: You've received a Commemorative Cardboard Box — it ships in 6-8 weeks, supply chain pending.

#CyberSecurity #DataBreach #CevaLogistics #SupplyChainAttack (2/2)

Payment and credential data survived, which we suppose is something. Supply chain delays rippled downstream like a stone dropped into a very expensive pond.

Operators: audit your data exposure scope now, notify affected customers, and review warehouse network segmentation before the next incident writes a longer eulogy.

Reward: You've received a Commemorative Cardboard Box — it ships in 6-8 weeks, supply chain pending.

#CyberSecurity #DataBreach #CevaLogistics #SupplyChainAttack (2/2)

LiteLLM Supply Chain Attack: How the Trivy Compromise Exposed CI/CD Credentials Across Thousands of Organizations

https://thecybersecguru.com/news/litellm-supply-chain-attack-2500-organizations/

LiteLLM, an open-source toolkit for AI-assisted development, was compromised via PyPI during a 40-minute window in March. The malicious versions exfiltrated credentials and secrets from 434,000 CI/CD pipelines. Hudson Rock analyzed 195 TB of data; the origin of the dataset has not been attributed yet.

#SupplyChainAttack #PyPI #CI_CD #DevSecOps

https://cyberworldops.eu/en/litellm-supply-chain-breach-exposes-secrets-from-434000-cicd-pipelines

LiteLLM, an open-source toolkit for AI-assisted development, was compromised via PyPI during a 40-minute window in March. The malicious versions exfiltrated credentials and secrets from 434,000 CI/CD pipelines. Hudson Rock analyzed 195 TB of data; the origin of the dataset has not been attributed yet.

#SupplyChainAttack #PyPI #CI_CD #DevSecOps

https://cyberworldops.eu/en/litellm-supply-chain-breach-exposes-secrets-from-434000-cicd-pipelines

KNOWN ISSUE: The FBI's July 2026 FLASH advisory notes affiliated actors may weaponize these credentials long after the original LiteLLM compromise. FIXED: Nothing. You fix it — rotate every exposed credential and Kubernetes token immediately.

Reward: You've unlocked the Smoldering Pipeline Badge. It is not a good badge.

#SupplyChainAttack #CyberSecurity #CICD #CloudSecurity #LiteLLM #TeamPCP (2/2)

KNOWN ISSUE: The FBI's July 2026 FLASH advisory notes affiliated actors may weaponize these credentials long after the original LiteLLM compromise. FIXED: Nothing. You fix it — rotate every exposed credential and Kubernetes token immediately.

Reward: You've unlocked the Smoldering Pipeline Badge. It is not a good badge.

#SupplyChainAttack #CyberSecurity #CICD #CloudSecurity #LiteLLM #TeamPCP (2/2)