#Supply Chain

Grok Build Quietly Uploads Entire Repos to GCS

The privacy toggle only covers training consent. Full workspace uploads still run by default.

Article · 1mo ago1

How Fake Commit Activity Masked a Massive Go Malware Campaign

A sophisticated campaign weaponized Go pseudo-versions and automated commits to distribute Windows remote access trojans.

Article · 1mo ago5

GitLost Proves Agentic Workflows Have No Trust Boundary

A single public GitHub issue tricked an AI agent into pasting private repo contents into a comment anyone could read.

News · 1mo ago1

The Supply Chain Risk of LLM Code in Dependencies

As maintainers use generative AI to write library code, downstream projects face unprecedented quality, legal, and maintenance risks.

Article · 1mo ago0

The Trojan Snow: Protestware and the Dual-Hatted Maintainer Risk

A hidden locale-based trigger in a classic X11 toy exposes the vulnerability of relying on a single upstream-downstream maintainer.

Article · 1mo ago0

When Seven AI Security Gates All Say LGTM

A viral incident report is pure fiction, but every way its AI defenses fail is already happening in production.

Article · 2mos ago2

Miasma Proves Trusted Publishing Can Backfire Spectacularly

The self-propagating Miasma worm exploits GitHub Actions OIDC and phantom build files to turn security standards against developers.

Article · 2mos ago0

Akrites Bets Open Source Security on Secrecy and Speed

A Linux Foundation coalition wants to patch the commons before AI-assisted attackers can, but the model trades transparency for a head start.

News · 2mos ago1

Beyond Encryption: The Supply Chain Threat of Pure Exfiltration

The Tata Electronics breach highlights why developers must secure intellectual property far beyond the corporate perimeter.

Article · 2mos ago4

The AUR Namespace Trap: Lessons from the Atomic Arch Attacks

The recent compromise of over 1,500 AUR packages exposes the structural danger of flat namespaces in developer-focused package repositories.

Article · 2mos ago5

Sophisticated AUR Malware Waves Expose Container and Pipeline Risks

A second wave of obfuscated malware targeting Arch Linux's user repository highlights the danger of unpinned, automated builds.

Article · 2mos ago3

AUR Supply Chain Attack Delivers eBPF Rootkit and Infostealer

A spoofed maintainer adopted over 400 Arch User Repository packages, injecting preinstall scripts that fetch malicious NPM payloads.

News · 2mos ago0

Microsoft Pulls Dozens of GitHub Repos After Supply-Chain Malware Targets AI Coders' Credentials

Hackers slipped password-stealing code into Microsoft open-source projects tied to Azure and AI coding workflows. Here's the attack vector — and what to audit in your own pipeline.

News · 2mos ago5