Avantages (suite)
- #nobuild : pas de build requis (oubliez npm et autres package.json) : le code écrit est exactement celui qui est exécuté sur le navigateur sans transformation. Les libs sont inclues dans un dossier "vendor" et ne sont pas téléchargées via un gestionnaire de dépendances (évite les #supplychainattack)
Kaspersky Uncovers Trojanized DAEMON Tools in Targeted Supply-Chain Attack
If you installed DAEMON Tools between April 8 and now, your system may be compromised - Kaspersky researchers warn that a highly sophisticated supply-chain attack has been delivering a backdoor to thousands of systems via trojanized installers. Check your machines for unusual activity and take action ASAP to…
#SupplyChainAttack #TrojanizedSoftware #DaemonTools #EmergingThreats #BackdoorMalware
Kaspersky Uncovers DAEMON Tools Supply Chain Attack
Kaspersky researchers have uncovered a sneaky supply chain attack that used compromised DAEMON Tools installers, downloaded directly from the official website, to deliver a malicious payload - and what's even scarier is that these installers were digitally signed by the very developers of DAEMON Tools themselves.
#SupplyChainAttack #DaemonTools #Kaspersky #EmergingThreats #MalwareOperations
Who submiitted the un-needed patch that created the problem?
Is Canonical intentionally delaying fix because the flaw is under active exploit?
Summary Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. On May 2, 2026, the ransomware group Everest claimed responsibility for a cyberattack against Symcor (symcor.com), a leading Canadian business process outsourcing company. The group issued a statement indicat...
Supply chain attack affecting Intercom has expanded beyond #npm and into the #PHP ecosystem.
`intercom/[email protected]`
https://github.com/intercom/intercom-php/security/advisories/GHSA-gr3r-crp5-qrrm
https://github.com/intercom/intercom-node/security/advisories/GHSA-54pg-9963-v8vg
https://www.intercomstatus.com/us-hosting/incidents/01KQFN6VS6ARP1XBR1K1SBYY59
https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm
https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise
#PHP #ComposerPHP #Composer #Intercom #SupplyChain #SupplyChainAttack #MiniShaiHulud
New supply chain attack:
Any of these in use?
```
Ruby:
knot-activesupport-logger
knot-devise-jwt-helper
knot-rack-session-store
knot-rails-assets-pipeline
knot-rspec-formatter-json
knot-date-utils-rb (Sleeper gem)
knot-simple-formatter (Sleeper gem)
Go:
github[.]com/BufferZoneCorp/go-metrics-sdk
github[.]com/BufferZoneCorp/go-weather-sdk
github[.]com/BufferZoneCorp/go-retryablehttp
github[.]com/BufferZoneCorp/go-stdlib-ext
github[.]com/BufferZoneCorp/grpc-client
github[.]com/BufferZoneCorp/net-helper
github[.]com/BufferZoneCorp/config-loader
github[.]com/BufferZoneCorp/log-core (Sleeper module)
github[.]com/BufferZoneCorp/go-envconfig (Sleeper module)
```
Read more here:
https://thehackernews.com/2026/05/poisoned-ruby-gems-andago-modules.html
PyTorch Lightning Targeted in PyPI Supply Chain Credential Heist
Malicious actors have struck PyTorch Lightning with a supply chain attack, publishing two tainted package versions that automatically steal credentials when imported. The attack involves a sneaky _runtime directory with a downloader and obfuscated JavaScript payload.
#PytorchLightning #SupplyChainAttack #Pypi #CredentialHeist #EmergingThreats
Mini Shai-Hulud: TeamPCP compromette i pacchetti npm ufficiali di SAP in un attacco supply chain enterprise
Il gruppo TeamPCP ha compromesso i pacchetti npm ufficiali di SAP in un attacco supply chain denominato 'Mini Shai-Hulud': versioni malevole pubblicate il 29 aprile 2026 rubano credenziali AWS, Azure, GCP, token GitHub e segreti CI/CD tramite un payload multistadio basato sul runtime Bun, con esfiltrazione cifrata su repository GitHub pubblici.
Marc Bouvier Lui/Il FR/EN
Analyst207
SpaceLifeForm
Bobe'bot on security
github.com/ghostwriter
Trumtins Electro Shark 325ppm
(in)sicurezza digitale