On October 29, 2026, trojanized builds (2.1.312 and 2.1.313) of the official Claude Code VS Code extension were published to Cursor's VS Code Extension Marketplace for macOS and Windows.

Binance’s November 3 findings trace the attack from a malicious interview assignment through developer tools, an internal AI tool, and stolen deployment credentials to wallet signing. We examine the ...

Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual ...

litellm 1.107.0 shipped a credential stealer and an hourly remote code loader in all seven PyPI wheels and the official Docker images. The attacker hijacked BerriAI's release workflow with a GitHub ...

An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence. We rebuilt the exact attacker build, recovered the GlassWorm loader from an ...

GhostAction returns: compromised maintainers push a fake security-audit.yml workflow that steals CI/CD secrets and cloud credentials from GitHub repos.

npm compromised package and cooldown checks Two StepSecurity GitHub Checks stop this kind of attack at the pull request, before anything is installed. The Package Compromised Updates check fails a PR ...

For MemoryOS 2.0.34, include hosts where a normal import could reach logging initialization. Remove or quarantine the affected release and use an independently vetted replacement; this inspection did ...

An external GitHub user exploited an exposed npm publishing workflow for @7nohe/openapi-react-query-codegen and shipped ten malicious versions that run attacker code during installation.

56 supply chain attacks in 12 months, each with a StepSecurity Threat Center alert. The data, the worms, the Team PCP numbers, and how to defend.

CloudSEK has published the victim list from Team PCP's supply chain campaign: 78,330 secrets exfiltrated from the CI/CD pipelines of 2,186 organizations over five days in March 2026. StepSecurity's ...

A self-propagating npm worm we call ChainDrop poisoned 444 packages and 2,212 versions in under four hours, starting with keyv@6.0.0. Full payload analysis, the affected package list, IOCs, and what ...