Experimental News Clipping Site

Tag: party dependencies

The Register: Not pretty, not Windows-only: npm phishing attack laces popular packages with malware

Jul 24, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.theregister.com/2025/07/24/not_pretty_not_windowsonly_npm/ Source: The Register Title: Not pretty, not Windows-only: npm phishing attack laces popular packages with malware Feedly Summary: The “is" package was infected with cross-platform malware after a scam targeting maintainers The popular npm package "is" was infected with cross-platform malware, around the same time that linting utility packages used with the…
Unit 42: Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files

Mar 18, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ Source: Unit 42 Title: Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files Feedly Summary: A compromise of the GitHub action tj-actions/changed-files highlights how attackers could exploit vulnerabilities in third-party actions to compromise supply chains. The post Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files appeared first…