Cybersecurity specialists have exposed a pervasive malicious campaign targeting developers, wherein the adversary bypassed the compromise of finished products to exploit vulnerabilities within the build process itself. By leveraging the public NPM registry, the...
Trajan: CI/CD Security Scanner Trajan scans CI/CD pipelines for security vulnerabilities that attackers use to compromise software supply chains. It supports GitHub Actions, GitLab CI, Azure DevOps, Jenkins, and JFrog. What it does Trajan...
Adversaries have once again targeted the npm supply chain, though this incursion pursued a surgical and perilous objective: packages integral to developers within the SAP ecosystem. The malicious campaign, designated “Mini Shai-Hulud,” appears modest...
The emergence of the nascent hacking collective Harakat Ashab al-Yamin al-Islamia has piqued the curiosity of security analysts following a spate of declarations regarding its operations within Europe. However, extant empirical evidence remains insufficient...
The cybercrime landscape has taken a definitive step toward “assembly-line” extortion. The Vect collective has established a dual partnership that radically simplifies the execution of assaults while exponentially expanding their reach. By aligning with...
Security researchers from the Tel Aviv-based firm Adversa have unearthed a vulnerability within Claude Code—the autonomous artificial intelligence programming agent authored by Anthropic. By enticing the agent with a sufficiently protracted sequence of subcommands,...
The ubiquitous axios library, an indispensable cornerstone of contemporary web development, has abruptly found itself at the epicenter of a profound cyber siege. Malefactors surreptitiously wove venomous code directly into the official iterations of...
The ubiquitous integration of artificial intelligence into software development over the past year has precipitously accelerated production cycles while concurrently exacerbating deeply entrenched security vulnerabilities. The nascent State of Secrets Sprawl 2026 dossier published...
An imperceptible edit to a single tag transformed a ubiquitous security auditing instrument into a clandestine backdoor. A malefactor compromised the official Xygeni GitHub Action, implanting a fully functional remote command shell capable of...
According to a StepSecurity report, over the past week, an unidentified bot with the telling name “hackerbot-claw” launched a relentless hunt against prominent open-source projects, clearly highlighting the lingering vulnerabilities within build infrastructures. This...
GHARF is an efficient support framework for Red Team exercises that applies the concept of CI/CD (Continuous Integration / Continuous Delivery). It can be used for exercises aimed at security assessment, research, and human...
An advertisement has surfaced on the BreachForums forum offering a large data archive for sale. According to the seller, operating under the alias “888,” the dataset is linked to Bitbucket repositories used in projects...
