Latest Software supply chain attack news

One North Korea-linked threat cluster now publishes malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist in parallel, reusing the same staging infrastructure and loader patterns. Socket has tracked more than 1,700 packages tied to the broader Contagious Interview …

Ten high-impact npm maintainers, including the engineers behind Fastify, Lodash, dotenv, and Express, were approached using the same playbook that compromised Axios. Tay attributes the campaign to UNC1069, the DPRK-nexus group that spent eight years perfecting fake interviews against crypto …

A poisoned Git tag turned a security vendor's own GitHub Action into a backdoor. The C2 implant in xygeni-action ran for seven days, giving attackers access to repo secrets on every workflow run. Same technique that hit tj-actions last year.