📰 WordPress Supply Chain Hit Again: ShapedPlugin Update Mechanism Compromised
⚠️ WordPress Supply Chain ATTACK: The update mechanism for ShapedPlugin has been hacked, pushing malicious code to sites via auto-updates. This is the 3rd major WP vendor hit recently. Review your plugins now! #WordPress #SupplyChainAttack #CyberSecu...
🌐 cyber[.]netsecops[.]io
📰 WordPress Supply Chain Hit Again: ShapedPlugin Update Mechanism Compromised
⚠️ WordPress Supply Chain ATTACK: The update mechanism for ShapedPlugin has been hacked, pushing malicious code to sites via auto-updates. This is the 3rd major WP vendor hit recently. Review your plugins now! #WordPress #SupplyChainAttack #CyberSecu...
🌐 cyber[.]netsecops[.]io
Supply-chain attacks move fast and get caught fast. A dependency cooldown, ignoring any version published less than a few days ago, blocks most of them for a one-line config change. Here is how to turn it on across npm, PyPI, NuGet, Maven, and your editor.
How 144 Mastra npm Packages Got Poisoned in Under an Hour And Nobody Noticed Until It Was Too Late
144 Mastra npm packages were compromised on June 17, 2026 via easy-day-js, a typosquatted dependency that drops a cross-platform infostealerhttps://thecybersecguru.com/news/mastra-npm-supply-chain-attack-easy-day-js/
"DepsGuard looks for npm, pnpm, yarn, bun, uv, pip, poetry, and aube on your machine, reads their config files, compares them to recommended supply-chain settings, and can apply fixes interactively. "
RE: https://fosstodon.org/@archlinux/116738652549604531
#Archlinux Supply chain incident shows the thing that always ignored by common people:
Expecting you are not the target, because people rarely used it.
Which points to: Attackers will do things where it is the place you are least expect.
📣🚨 Over 20 Linux packages were compromised in the #AtomicArch campaign, which abuses AUR ownership transfers to drop rootkit-like malware.
Read: https://hackread.com/atomic-arch-hijacks-linux-aur-packages-malware/
@sodiboo @ifin @threatintel Made a consolidated AUR malware checker for the atomic-lockfile supply-chain attack now on GitHub.
Merges detection scripts from the gist[1] and Kidev, BrianCArnold, commonsourcecs, Kacper-Kondracki, quantenProjects, Andre Herbst, ioctl.fail, and Kusoneko into a single repo. Checks known compromised packages, scans pacman.log history, checks for systemd persistence and eBPF rootkit artifacts.
https://github.com/lenucksi/aur-malware-check
UPDATE 7/13/26: Friendly contributors added a 'download official arch hedgedoc list' and the new new bun package and I added some more convenience features.
[1] https://gist.github.com/Kidev/59bf9f5fb53ab5eee99f19a6a2fc3992
#AUR #ArchLinux #SupplyChainAttack #Malware #InfoSec #atomiclockfile
🚨 NEWS: Microsoft: repository GitHub hackerati per rubare password degli sviluppatori AI
Ecco i punti chiave in breve:
💡 Un attacco mirato ai repository open source di Microsoft ha esposto le credenziali di migliaia di sviluppatori AI. La società ha disattivato decine di repository GitHub dopo che un...
#supplyChainAttack #microsoftGitHubHack #credentialStealerSviluppatoriAI #sicurezzaRepositoryOpenSource #furtoPasswordAI
CyberNetsecIO
Tomas Ekeli
The CyberSec Guru
fzap
K-Toast 
AmmarSpaces
Hackread.com
JTI
Meteora Web