~ / topics / Supply chain

Supply chain

5 stories on this subject, newest first.

5 storiesSecurity

summarylive

entries5

latest30 Oct

all subjectsA–Z

~/topics/supply-chain — entries5

Friday 30 October 20261 story

Security / Supply chain

The official Claude Code extension bundle on the Cursor Marketplace carried an SSH backdoor

Phorion reports a backdoor in the Claude Code for VS Code extension bundle distributed through the Cursor Marketplace, which planted an SSH key, opened a reverse tunnel and installed persistence on macOS, Linux and Windows. Cursor pulled version 2.1.313 from its marketplace and the NPM and VS Code registries. The advisory lists the bundle hash, two key fingerprints and the tunnel server, and a macOS bug blunts the inbound path without removing the persistence.

3 min read

Tuesday 6 October 20261 story

Security / Supply chain

The repo that wasn't: a fake client and a post-checkout hook

Frank Wiles describes a targeted attack that arrived as a normal project inquiry and hid a .git repository whose post-checkout hook fetched and ran an OS-specific binary on branch switch.

2 min read

Wednesday 23 September 20261 story

Security / Supply chain

The Terraform registry has malware now, and it stays asleep until one hash matches

Aikido found a Go implant in two registry providers and two Go modules. It does nothing unless the SHA256 of two Terraform variables hits one value, then runs a remote-access tool with Slack and Ethereum command channels. Both providers were still listed on Wednesday night.

2 min read

Tuesday 22 September 20262 stories

Security / Supply chain

CrowdSec's private repos left through an access it kept open, and a breach forum told it

Nine minutes of downloads in May, four months of quiet, and an incident report that names the kept-alive account and the compromised laptop behind it.

3 min read

Security / Supply chain

An npm maths library that only wakes up when you solve the right equation

mathmain ships an encrypted implant that stays dormant until a caller passes one specific matrix to its solver, and the code is missing from the GitHub repository the package links to.

2 min read

more insections

Security→