NewsBleepingComputer30.07.2026SME Finance

Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers

Teaser from the source

Amazon linked multiple high-profile open-source software supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers. [...]

This is the RSS-feed teaser. Read the full article at the original source.

Read at BleepingComputer

Other advisories

Not ratedosv:GHSA-93qj-5q5v-3c2hTrojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
Criticalghsa:GHSA-93qj-5q5v-3c2hTrojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
Not ratedosv:GO-2026-5416gitverify has improper tag signature verification in github.com/supply-chain-tools/gitverify
HighCVE-2026-41387OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides
Not ratedosv:CVE-2026-28500ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
CriticalCVE-2026-28500ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
CriticalCVE-2026-27180MajorDoMo (auch Major Domestic Module) ist anfällig für nicht authentifizierte Remote-Code-Ausführung durch Supply-Chain-Kompromittierung via Vergiftung der Update-URL.
CriticalCVE-2018-25117VestaCP-Commits a3f0fa1 (2018-05-31) bis ee03eff (2018-06-13) enthielten eingebetteten Schadcode, der zu einem Supply-Chain-Angriff führte.

Other news entries

Source: https://www.bleepingcomputer.com/news/security/amazon-links-debug-chalk-npm-supply-chain-attacks-to-north-korean-hackers/

More on supply-chain

Other advisories

Other news entries