OpenAI says attackers behind the TanStack npm supply chain compromise stole internal credentials after reaching two employee devices, forcing the company to rotate signing certificates for several desktop products.
The company disclosed this week that it had been caught up in the wider “Mini Shai-Hulud” campaign targeting npm ecosystems and developer infrastructure, though it said there was no evidence that customer data, production systems, or deployed software were compromised.
Read more…
Source: The Register News
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- CISA: Kaseya VSA Supply-Chain Ransomware Attack
July 2, 2021
CISA is taking action to understand and address the recent supply-chain ransomware attack against Kaseya VSA and the multiple managed service providers (MSPs) that employ VSA software. CISA encourages organizations to review the Kaseya advisory and immediately follow their guidance to shutdown VSA servers. Source: Cybersecurity and Infrastructure Security Agency KASEYA VSA Important Notice July 2nd, 2021 KASEYA VSA ...
- ICT SPRING 2021: physical edition to reconnect to business
June 1, 2021
The international tech summit will take place next September 14-15, 2021 Press Release Luxembourg, June 1st, 2021 – Next September 14th and 15th, more than 100 international experts will participate in a new edition of ICT Spring, the renowned tech summit. The event, organized since 2010, will take place at the European Convention Center Luxembourg, at the ...
- IT threat evolution Q1 2021
May 31, 2021
In December, SolarWinds, a well-known IT managed services provider, fell victim to a sophisticated supply-chain attack. The company’s Orion IT, a solution for monitoring and managing customers’ IT infrastructure, was compromised by threat actors. This resulted in the deployment of a custom backdoor, named Sunburst, on the networks of more than 18,000 SolarWinds customers, including ...
- UK government seeks advice on defending against supply-chain cyberattacks
May 17, 2021
Today, the UK government has announced a call for advice on defending against software supply-chain attacks and ways to strengthen IT Managed Service Providers (MSPs) across the country. The move comes after last week when President Biden had issued an executive order to increase cybersecurity defenses across the U.S. The government’s invitation to provide feedback that will ...
- Rapid7 source code, alert data accessed in Codecov supply chain attack
May 14, 2021
Rapid7 has disclosed the compromise of customer data and partial source code due to the Codecov supply chain attack. On Thursday, the cybersecurity firm said it was one of the victims of the incident, in which an attacker obtained access to the Codecov Bash uploader script. The cyberattack against Codecov took place on or around January 31, ...
- Biden Administration Drafting EO to Help U.S. Government Secure Digital Supply Chain
May 3, 2021
Biden Administration Drafting EO to Help U.S. Gov’t Secure Digital Supply Chain The Biden administration said it’s drafting an executive order to help the United States government better defend itself against digital supply chain attacks. A Step Up for Federal Procurement According to NPR, the executive order that’s being drafted will include several initiatives designed to strengthen the ...