32 Red Hat npm packages compromised by Miasma malware expose cloud tokens, CI/CD secrets and developer credentials in supply chain attack.
Tag: CI/CD
AI, Data Breaches, Exploits, Global Security News, Network Security, Risk Management
Claude Code GitHub Actions Flaw Created Supply Chain Attack Risk
Organizations using Claude Code GitHub Actions should review their CI/CD environments after a researcher found vulnerabilities that could expose repositories to compromise and supply chain attacks. The flaws, which have since been patched, allowed attackers to bypass permission controls and inject untrusted input into trusted workflows. These vulnerabilities allow “… an attacker [to] bypass its…
AI, Cloud Security, Cybersecurity, Data Breaches, Europe, Exploits, Global Security News, Government & Policy, Network Security, Risk Management
Supply Chain Attacks, AI Security, and Major Breaches Define This Week in Cybersecurity in May 2026
Major Threats & Vulnerabilities Software Supply Chain and CI/CD Exploits Researchers uncovered a malicious campaign targeting SAP npm packages that secretly stole developer and CI/CD credentials through preinstall scripts and GitHub-based command and control. SAP has yet to comment on the incident, which highlights the growing risk of dependency poisoning in enterprise ecosystems. Another critical…
AI, Data Breaches, Exploits, Global Security News, malware
Malicious LiteLLM versions linked to TeamPCP supply chain attack
TeamPCP backdoored LiteLLM v1.82.7–1.82.8, likely via Trivy CI/CD, adding tools to steal credentials, move in Kubernetes, and keep persistent access. Threat actor TeamPCP compromised LiteLLM versions 1.82.7 and 1.82.8, likely through a Trivy CI/CD breach. LiteLLM, with over 95 million monthly downloads, helps developers route LLM requests via a single API. The malicious releases, now…
GeekGuyBlog
Trivy Supply Chain Attack Targets CI/CD Secrets
A recent supply chain attack on the Trivy tool exposes critical CI/CD secrets, raising concerns for software developers about security vulnerabilities.
AI, Compliance, Global Security News
Plumber: Open-source scanner of GitLab CI/CD pipelines for compliance gaps
GitLab CI/CD pipelines often accumulate configuration decisions that drift from security baselines over time. Container images get pinned to mutable tags, branches lose protection settings, and required templates go missing. An open-source tool called Plumber automates the detection of those conditions by scanning pipeline configuration and repository settings directly. What Plumber checks Plumber reads a…
AI, Global Security News, Risk Management
Chainguard locks down CI/CD with secure-by-default actions
Chainguard has announced Chainguard Actions, secure-by-default workflows for CI/CD pipelines that allow developers and AI agents to ship quickly without introducing software supply chain risk. Using an agentic approach, Chainguard Actions provides a continuously secured catalog of workflows maintained by the Chainguard Factory, the infrastructure that has become the industry standard for delivering trusted open…