Latest Software supply chain attack news

Ten high-impact npm maintainers, including the engineers behind Fastify, Lodash, dotenv, and Express, were approached using the same playbook that compromised Axios. Tay attributes the campaign to UNC1069, the DPRK-nexus group that spent eight years perfecting fake interviews against crypto …

A poisoned Git tag turned a security vendor's own GitHub Action into a backdoor. The C2 implant in xygeni-action ran for seven days, giving attackers access to repo secrets on every workflow run. Same technique that hit tj-actions last year.