… A Vercel security bulletin says that on April 19, the company “identified a security incident that involved unauthorized access to certain internal Vercel systems” and led to credential compromise for “a limited subset of customers.” The company contacted those customers and “recommended an immedia… …
… According to security researcher Rami McCarthy , 19 of the 25 accounts used to post were also used in the Trivy spam campaign. The Python Packaging Authority PyPA has published a security advisory about the LiteLLM compromise. …
… After all of these attacks, Google-owned cloud security shop Wiz said its researchers "saw indications in Cloud, Code, and Runtime evidence that the credentials and secrets stolen in the supply chain compromises were quickly validated and used to explore victim environments and exfiltrate additiona… …
… At that time, every repo's description said: " TeamPCP Owns Aqua Security." According to Socket, "while the full scope of this access remains unclear, the presence of these repositories indicates a deeper level of control over the GitHub organization during the compromise." ® open source special fe…
… So with this success, I expect to see more." Vuln scanner as initial attack vector TeamPCP compromised Trivy, an open source vulnerability scanner maintained by Aqua Security in late February, then injected credential-stealing malware into the scanner on March 16 through the binary, GitHub Actions,… …
… "Attackers are starting to really look at the supply chain and open source packages, and figure out ways to compromise developers to deliver malware or gather data, depending on the type of threat," Biasini said. ® cyber-crime open source linux foundation google cloud cybercrime security
… Ox Security warned on Friday that TeamPCP - the group researchers link to the recent compromise of open-source vulnerability scanner Trivy, which led to malicious LiteLLM packages appearing on PyPI - is back, this time with another compromise of a legitimate software package. …
… This makes it easy for the user to sign in, but it comes with a security tradeoff. …
… Security firm StepSecurity found that both versions were published via the compromised npm account of "jasonsaayman," the project's primary maintainer, who was reportedly locked out of the account while the packages were being pushed. …
… The blog also includes a list of indicators of compromise, including the GitHub repositories with the trojanized Claude Code leak and malware hashes to help defenders in their threat-hunting efforts, so be sure to check that out - and, as always, be careful what you download. ® zscaler security cyb…