Explore

Rapid Read Rapid Read
OpenAI Affected by TanStack Supply Chain Attack, Security Measures Implemented

OpenAI Affected by TanStack Supply Chain Attack, Security Measures Implemented

OpenAI has been impacted by a supply chain attack involving the TanStack web application development stack. The attack, executed by the TeamPCP hacking group, compromised over 170 packages across NPM and PyPI namespaces. Two OpenAI employee devices were infected, leading to the exfiltration of credentials and secrets. In response, OpenAI has rotated credentials, revoked user sessions, and restricted code-deployment workflows. The company has also revoked and re-signed code-signing certificates for its applications to prevent further risks.
Trendline Trendline
OpenAI Faces Security Breach from TanStack Supply Chain Attack

OpenAI Faces Security Breach from TanStack Supply Chain Attack

OpenAI Faces Security Breach from TanStack Supply Chain Attack
Trendline Trendline
OpenAI Confirms Data Theft Following Supply Chain Attack on Open Source Projects

OpenAI Confirms Data Theft Following Supply Chain Attack on Open Source Projects

OpenAI Confirms Data Theft Following Supply Chain Attack on Open Source Projects
Trendline Trendline
OpenAI Confirms Data Breach Following Supply-Chain Attack on TanStack

OpenAI Confirms Data Breach Following Supply-Chain Attack on TanStack

OpenAI Confirms Data Breach Following Supply-Chain Attack on TanStack
Trendline Trendline
OpenAI Data Breach Highlights Supply Chain Vulnerabilities

OpenAI Data Breach Highlights Supply Chain Vulnerabilities

OpenAI Data Breach Highlights Supply Chain Vulnerabilities
Rapid Read Rapid Read
Node-ipc npm Package Faces Supply Chain Attack Due to Expired Domain

Node-ipc npm Package Faces Supply Chain Attack Due to Expired Domain

A significant supply chain attack has been identified involving the node-ipc npm package, a widely used Node.js module. Attackers exploited an expired domain to publish three trojanized versions of the package, specifically versions 9.1.6, 9.2.3, and 12.0.1. These versions contain an obfuscated 80KB payload designed to steal credentials for various services, including CI/CD tools, cloud services, and AI coding agents. The stolen data is exfiltrated using DNS TXT queries, a method that allows attackers to bypass traditional HTTP connections. Node-ipc is a dependency for over 424 projects and receives nearly 700,000 weekly downloads, indicating a potentially vast impact. Users are advised to scan their systems for these compromised versions and treat any stored credentials as compromised.
Trendline Trendline
Cisco Faces Security Threat as Zero-Day Vulnerability Exploited by Persistent Threat Group

Cisco Faces Security Threat as Zero-Day Vulnerability Exploited by Persistent Threat Group

Cisco Faces Security Threat as Zero-Day Vulnerability Exploited by Persistent Threat Group
Trendline Trendline
PraisonAI Vulnerability Exposes API Server to Unauthorized Access

PraisonAI Vulnerability Exposes API Server to Unauthorized Access

PraisonAI Vulnerability Exposes API Server to Unauthorized Access
Rapid Read Rapid Read
Congress Demands Answers from Instructure Over Canvas Data Breach

Congress Demands Answers from Instructure Over Canvas Data Breach

The US House of Representatives is seeking testimony from Instructure, the company behind the education platform Canvas, following two cyberattacks that compromised the personal information of millions of students and teachers. The hacker group ShinyHunters breached the platform in April and again in May, targeting thousands of educational institutions. Instructure reached an agreement with the hackers to destroy the stolen data, but Congress is questioning the company's response and coordination with the Cybersecurity and Infrastructure Security Agency (CISA). The breach exposed sensitive information, including usernames, email addresses, and course details.
Trendline Trendline
Supply Chain Attack: 'Mini Shai-Hulud' Malware Targets Open-Source Packages

Supply Chain Attack: 'Mini Shai-Hulud' Malware Targets Open-Source Packages

Supply Chain Attack: 'Mini Shai-Hulud' Malware Targets Open-Source Packages
Trendline Trendline
RubyGems Suspends Registrations Following Malicious Package Attack

RubyGems Suspends Registrations Following Malicious Package Attack

RubyGems Suspends Registrations Following Malicious Package Attack
Trendline Trendline
Instructure Reaches Agreement with Hackers to Retrieve Stolen Data

Instructure Reaches Agreement with Hackers to Retrieve Stolen Data

Instructure Reaches Agreement with Hackers to Retrieve Stolen Data