Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

3 Software Supply Chain Risks in 2023

netspi.com | blog | #supply-chain | #npm | #pypi | #typosquatting | #package-managers | #dependency-confusion

Summary

Software supply chain attacks in 2023 cluster into three categories: package manager attacks like dependency confusion and typosquatting, developer compromise, and breaches at large software vendors.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Think Outside the Prompt: Creative Approaches to Attacking AI
Using the PyTorch-nightly compromise as a case study, this post explores attacking AI via its supply chain: typosquatted dependencies, credential theft from build machines, and model integrity risks.
blog · about.gitlab.com
Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting
GitLab researchers found five malicious PyPI packages, including typosquats of Flask, Requests, and NumPy, that deploy the Shai-Hulud worm via .pth files to steal CI/CD credentials.
blog · aikido.dev
Graphalgo campaign spreads to Terraform providers and Go Modules
Go malware has appeared in two Terraform providers and two Go modules — the first observed abuse of Terraform providers. The Graphalgo Go port hides a hash-gated trigger with blockchain and Slack C2.
incident · netspi.com
LiteLLM Supply Chain Compromise
Malicious PyPI builds of LiteLLM 1.82.7/1.82.8, published via a compromised maintainer account, exfiltrated API keys and system data, exposing a user's entire LLM provider surface.
incident · blog.trailofbits.com
Supply chain attacks are exploiting our assumptions
From typosquatting to poisoned pipelines, supply chain attacks exploit implicit trust in package registries; tools like TypoGard, Zizmor, and PyPI Trusted Publishing make trust verifiable.
research · lab.ctbb.show
From DEF CON Research to Automated Supply Chain Defense, finding npx confusion vulnerabilities with npxconfuse
The npxconfuse scanner automates detection of npx confusion and scoped binary name mismatches, finding unclaimed npm package names in codebases and GitHub orgs, including a Brave MCP server zero-day.
back