🛡️ Building open-source AI & cybersecurity infrastructure with Rust.

Current projects from BAKOME-Hub include:
• Supply chain security scanners
• AI terminals
• Dependency analyzers
• Trading intelligence systems
• Automation dashboards

Main stack:
Rust • Python • Pine Script • MQL5

Everything is open source:
github.com/BAKOME-Hub

Seeking collaboration and guidance from @sovtechfund and @SovereignTechAgency around:
#OpenSource #Rust #CyberSecurity #SupplyChainSecurity #AI

Introducing wormbox!

Transparent sandbox + pre-install audit for the macOS Node.js toolchain (npm, pnpm, yarn, bun). Every install runs under sandbox-exec; the audit reads tarballs first and flags the shapes seen in chalk, debug, Shai-Hulud: window.ethereum proxies, atob+eval lifecycle scripts, decoded payloads fed to Function(). AWS_*/GH_TOKEN never reach postinstall.

https://codeberg.org/head1328/wormbox

#SupplyChainSecurity #SandboxExec #NodeJS #PackageSecurity

This week’s major cyber trends:
• Massive npm/PyPI supply chain attacks
• Suspected AI-assisted zero-day exploit development
• Ransomware groups shifting toward silent extortion
• Active cPanel exploitation campaigns
• Fake Claude.ai malware delivery targeting macOS

https://www.technadu.com/cybersecurity-news-roundup-cybercrime-shifts-toward-faster-supply-chain-attacks-silent-extortion-and-real-world-consequences/627920/

#CyberSecurity #ThreatIntel #SupplyChainSecurity #InfoSec

We hope you enjoyed @glaubinix talk on the malware filtering features in Composer 2.10 at phpday. Try them out on latest snapshots today. Appreciate early feedback! Proud to sponsor @phpday in Verona, Italy!

Slides at https://glaubinix.github.io/talks/2026-05-15-Composer-2-10-Malware-Filtering.html

#php #phpc #phpday #composerphp #supplychainsecurity #malware

Hackers earning millions from hijacked cargo, FBI says

FBI는 최근 2년간 해커들이 중개업체와 운송업체 시스템을 침해해 화물 운송 메시지 게시판에 사기성 게시물을 올리고, 배송 경로를 변경해 수백만 달러 상당의 화물을 탈취하는 사례가 급증했다고 경고했다. 2025년 미국과 캐나다에서 발생한 화물 절도 피해액은 전년 대비 60% 증가했으며, 해커들은 이메일 스푸핑과 악성 링크를 통해 시스템 접근 권한을 획득하고, '더블 브로커링' 수법으로 배송 체인을 조작한다. 피해 기업들은 해커로부터 몸값 요구 연락을 받기도 하며, 운송업계 전반에 걸쳐 심각한 보안 위협으로 대두되고 있다.

https://therecord.media/hackers-earning-millions-from-hijacked-cargo-fbi

#cybersecurity #cargotheft #fbi #supplychainsecurity #cybercrime

Ask HN: How do you defend against supply chain attacks today?

최근 NPM과 PyPI 패키지에서 소프트웨어 공급망 공격이 빠르게 증가하고 복잡해지고 있다. 기존 의존성 스캐너는 대응 속도가 느리고, 자동 업데이트는 악성코드 포함 위험이 있어 효과적이지 않다. 모든 의존성 버전을 일일이 감사하는 것은 비용이 많이 들기 때문에, 개발자들은 보다 효율적이고 신속한 공급망 공격 방어 전략을 모색 중이다.

https://news.ycombinator.com/item?id=48134972

#supplychainsecurity #npm #pypi #dependencysecurity #softwaresecurity

Dear opensource developers,

I added an "adoption" list to the repro-env README, if you publish pre-compiled binaries and you successfully adopted it to allow anyone to reproduce them from source code to prove the absense of a build server compromise, you are very welcome to add yourself to the list. 😺

https://github.com/kpcyrd/repro-env#adoption

#reproducible #reproduciblebuilds #supplychainsecurity #rust

OpenAI says the recent TanStack npm supply-chain attack did not compromise production systems or user data, though 2 employee devices were impacted.

The company isolated systems, restricted deployments, and rotated code-signing certificates.

https://www.technadu.com/openai-addresses-tanstack-npm-supply-chain-attack-impact-%e2%81%a0production-systems-intellectual-property-not-compromised/627878/

#CyberSecurity #SupplyChainSecurity #DevSecOps #InfoSec

TeamPCP claims it breached Mistral AI while the company confirms impact from the TanStack supply chain attack involving malicious NPM and PyPI packages.

Mistral says there’s currently no evidence of an internal infrastructure breach.

https://www.technadu.com/teampcp-claims-mistral-ai-breach-the-company-announces-being-impacted-by-the-tanstack-supply-chain-attack/627870/

#Cybersecurity #SupplyChainSecurity #AI #Infosec

TeamPCP open-sourced its npm supply chain worm under MIT license. 7 attacks since January — SAP, Trivy, LiteLLM, TanStack (12.7M downloads), Mistral AI. Now anyone can clone it. Valid SLSA provenance on malicious packages. 
Audit your CI/CD runners today.

#SupplyChainSecurity