supply-chain

GlassWorm Is Hiding Malware in Invisible Code and Pushing It Into Your Python Repos

John Z Black Mar 17, 2026

Supply Chain & Software Security #supply-chain #glassworm #github #python #malware #unicode #developer-security

GlassWorm steals GitHub tokens, then injects malicious code written in invisible Unicode characters into repos developers already trust. 151 packages hit in one week.

The Week Trust Kept Breaking

John Z Black Mar 15, 2026

Weekly Recap #the-week-in-cyber #iran-cyber #supply-chain #ai-agents #patch-management #ransomware #privacy #cisa

Iranian wipers, poisoned dev tools, AI agents as attack surfaces, patches that never stopped coming, and a ransomware negotiator working for the bad guys. Trust fell apart in every direction this week.

The Software You Trust Is Becoming the Attack: Two Supply-Chain Strikes in One Week

John Z Black Mar 15, 2026

Threat Intelligence #supply-chain #developer-security #vs-code #appsflyer #malware #sdk-security

GlassWorm hijacked VS Code extension dependencies. AppsFlyer's SDK got compromised to serve crypto stealers. Both attacks exploited trust, not carelessness.

North Korea Behind Polyfill.io? Supply Chain Poisoning Just Got a State Sponsor

John Z Black Mar 13, 2026

Supply Chain Security #supply-chain #north-korea #polyfill #npm #simple-git #javascript #cve

Forensic research links the Polyfill.io supply chain attack to a North Korean operative. The same week, a CVSS 9.8 RCE hits the simple-git npm library. Your dependency graph is your attack surface.

Developer Supply Chains Under Coordinated Assault: 88 Malicious npm Packages and a CVSS 9.8 in simple-git

John Z Black Mar 12, 2026

Developer Security #npm #supply-chain #developer-security #phantomraven #simple-git #ci-cd #aws #devsecops

PhantomRaven dropped 88 malicious npm packages targeting AWS credentials and CI secrets. A critical RCE in simple-git threatens millions of dev environments. Your developer toolchain is a target.

Your Vendors Got Hacked: Supply Chain Breaches Keep Piling Up

John Z Black Mar 10, 2026

Breaches & Incidents #supply-chain #salesforce #shinyhunters #healthcare #cognizant #trizetto #ericsson #breach

ShinyHunters hit 400 companies through Salesforce misconfigs. Cognizant lost 3.4 million patient records. Ericsson got popped via a vendor. The supply chain is the perimeter now, and it's breaking.

Your AI Assistant Is an Attack Surface Now

John Z Black Mar 10, 2026

AI & Security #ai-security #openclaw #supply-chain #prompt-injection #nation-state #attack-surface

Exposed admin panels leaking API keys, prompt injection as a supply chain weapon, fake installer packages on npm, and nation-states using AI to hack at scale. AI agents just became everyone's security problem.