Tagged “supplychain”
6 posts
CircleCI Breach: Stolen Session Cookies and Your CI Secrets
One infected engineer laptop, one stolen SSO session, and every customer secret in CircleCI was in play. What failed, the blast radius, and how to make CI secrets cheap to rotate.
The chalk/debug npm Compromise: Anatomy of a Package Hijack
One phished maintainer turned 18 ubiquitous npm packages into a crypto-stealing payload in about two hours. Here is how it worked and the build-pipeline controls that blunt it.
Browser Extension Supply Chain Attacks: Trusted Update, Hostile Code
The Cyberhaven extension compromise showed how one phished developer account turns a trusted browser extension into a session-token thief — and how to defend against it.
Malicious Docker Hub Images Are Hiding in Plain Sight
Typosquatted and trojanized public container images have quietly served cryptominers and backdoors for years — why registry pulls need the same scrutiny as package installs.
Shai-Hulud Turns Your Own Laptop Into a GitHub Actions Runner
The Shai-Hulud npm worm backdoors developer machines by registering them as self-hosted GitHub Actions runners, then uses GitHub Discussions as its command channel.
CVE-2025-30066: The GitHub Action Tag You Trusted Lied
A compromised maintainer token let attackers rewrite tj-actions/changed-files version tags, dumping CI/CD secrets from thousands of repos into public build logs.