Tag

supply chain security

5 stories

How a Tampered Claude Code Extension Can Give Attackers Persistent SSH Access

A recent analysis by OpenSourceMalware found a tampered Claude Code extension on Open VSX that can give attackers persistent remote access to developer systems. The altered package, identified as anthropic.claude-code version 2.1.313, injects a short JavaScript loader that runs during normal extension activity and implements an SSH backdoor, reverse tunneling, and cross-platform persistence mechanisms. The sample analyzed targeted macOS on Apple Silicon, though the injected code contains branches for Linux…

Saugata DattaOct 30, 20264 min read36

Cybersecurity

Brotli Decoder Bug Sparks Cross-Platform RCE Risk — What to Know and Do

A memory-corruption flaw in Google's Brotli decoder (tracked as CVE-2026-111497) has rippled through numerous runtimes and libraries that embed the decoder, creating potential crash, memory-leak, or remote code execution vectors when untrusted Brotli-compressed data is processed. The issue was disclosed on October 21 after fixes began appearing in Node.js and Google’s Brotli source, and researchers from Imperva demonstrated code execution against an unpatched Node.js build. No confirmed in-the-wild exploitation has…

Saugata DattaOct 24, 20264 min read104

Cybersecurity

109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware

A large-scale campaign recently uncovered shows how attackers abused the trust developers place in open-source hosting to distribute two dangerous malware families, SmartLoader and StealC. By cloning legitimate projects and burying malicious ZIP archives deep inside repository structures, the threat actor made harmful downloads look like routine releases. For many victims the repository looked authentic at a glance: real source files remained intact, but documentation and release links silently pointed…

Saugata DattaApr 23, 20264 min read499

Artificial Intelligence

OpenAI Revokes macOS App Certificate After Axios Supply-Chain Compromise

OpenAI has publicly disclosed a supply‑chain incident that affected the signing workflow for its macOS applications and, out of caution, is revoking and rotating the certificate used to notarize those apps. The company’s investigation found that a GitHub Actions workflow used in the macOS signing process pulled a compromised release of the widely used npm library Axios (version 1.14.1). Although OpenAI reports no evidence of user-data exfiltration or system compromise,…

Saugata DattaApr 13, 20265 min read405

Artificial Intelligence

OpenAI Codex Command-Injection Flaw: How GitHub Tokens Were Exposed and What Teams Must Do Now

The rise of AI coding assistants has simplified developer workflows, but a recent discovery shows those conveniences can carry serious risk. Researchers at BeyondTrust found a critical command-injection vulnerability in OpenAI Codex that could be exploited to steal GitHub access tokens. The flaw demonstrates how an overlooked parsing detail — a branch name passed into a container setup script — became an escape hatch for attackers to extract secrets and…

Saugata DattaApr 7, 20265 min read427

How a Tampered Claude Code Extension Can Give Attackers Persistent SSH Access

Brotli Decoder Bug Sparks Cross-Platform RCE Risk — What to Know and Do

109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware

OpenAI Revokes macOS App Certificate After Axios Supply-Chain Compromise

OpenAI Codex Command-Injection Flaw: How GitHub Tokens Were Exposed and What Teams Must Do Now

Free Tools: IP, DNS, SSL