Supply Chain Security
Compromised packages, dependency attacks and the software supply chain.
IronWorm’s Rust Engine Is Rewriting the Rules of Open Source Supply Chain Attacks
A newly discovered Rust-based malware campaign, IronWorm, is hijacking npm packages to steal credentials, self-propagate via Trusted Publishing, and exfiltrate data through GitHub Actions—turning developer workflows into attack vectors.
How TeamPCP Turned Loose Secrets and Unpinned Actions Into a Supply Chain Juggernaut
An analysis of TeamPCP's Shai-Hulud campaigns, detailing how simple configuration failures, stolen tokens, and unpinned CI/CD workflows allowed an opportunistic threat group to compromise major open-source ecosystems like LiteLLM and TanStack.
AI-Triggered Credential Theft: The Microsoft Supply Chain Breach in Focus
An analysis of the recent Miasma supply chain worm that compromised 73 Microsoft-signed open-source packages, targeting developer AI coding assistants.
Credential Leak at Oxford Career Platform Exposes Third-Party Risks in Higher Ed
A comprehensive analysis of the University of Oxford's CareerConnect breach and its implications for higher education supply chain security.
Hybrid Sovereignty: Reclaiming Cognitive Independence
An exploration of how individual cognitive habits and national policy interact to preserve sovereignty in an age of AI dependency.
IronWorm Malware Hits 36 npm Packages in Supply Chain Attack
A new infostealer malware named IronWorm has compromised 36 packages on the npm index, targeting 86 environment variables and 20 credential files—including OpenAI, AWS, Anthropic, npm credentials, vault configs, SSH keys, and Exodus wallet files. The Rust-based malware hides behind an eBPF rootkit, uses Tor for C2, self-propagates via stolen npm credentials (including Trusted Publishing secrets), and can leverage GitHub Actions to upload exfiltrated data as build artifacts.
Red Hat npm Packages Compromised in Supply-Chain Attack Distributing Miasma Malware
More than 30 npm packages under Red Hat's '@redhat-cloud-services' namespace were compromised in a supply-chain attack distributing the Shai-Hulud credential-stealing malware, dubbed "Miasma."
Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories
The attacks stemmed from a GitHub account that was also compromised in a previous Miasma attack on Microsoft last month.
Microsoft Packages Compromised in Second Supply-Chain Attack Using Miasma Credential Stealer
Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents. The attack, linked to threat actor TeamPCP, used the Miasma worm to steal OIDC tokens and bypass SLSA provenance verification, exploiting trust in legitimate workflows. GitHub disabled 73 packages for TOS violations without labeling them malicious.
The AI Dependency Paradox: How Chatbot Reliance Weakens Independent News Verification
While AI chatbots can initially boost fact-checking accuracy by 21%, a new MIT Media Lab study reveals a disturbing long-term dependency. As users habituate to AI-assisted verification, their ability to independently detect misinformation significantly degrades, creating a 'GPS effect' where the human mind loses its inherent news-literacy map.
SynthWave: AI-Powered Supply Chain Attacks with Model Composition
A deep dive into SynthWave—a previously undocumented cyberattack campaign that uses fine-tuned open-weight LLMs to generate human-like code for supply chain attacks on npm and PyPI. Learn how model composition increased attack success by 300% and what it means for software security.
The Miasma Worm: A Self-Replicating Supply Chain Attack Targeting AI Coding Agents
The Miasma worm is a credential-stealing supply chain attack framework that has compromised 73 Microsoft-affiliated GitHub repositories. This autonomous worm uses compromised developer credentials to spread through CI/CD pipelines and specifically targets environments with automated AI tools.