Tag
supply-chain
7 posts with this tag.
·6 min read
ConnectWise Cloud Backup Breach: What to Check in M365
Microsoft tied the ConnectWise Cloud Backup (SkyKick) breach to Storm-0940 and an AI attack tool. The app IDs to find in Entra and what to check next.
·7 min read
LiteLLM 1.107.0 malware and Railway leak: keys to rotate
LiteLLM 1.107.0 shipped a credential stealer and Railway says env vars may have leaked. The AI keys to rotate, plus the PHP, GitLab and Chrome patches.
·7 min read
OpenAI agents and the RubyGems attack: what's confirmed
RubyGems confirms a May spam campaign and yanked malicious gems; researchers blame OpenAI agents; OpenAI hasn't verified it. Timeline, sources, vendor clause.
·8 min read
LiteLLM supply chain attack: what to check and rotate
Poisoned LiteLLM 1.82.7 and 1.82.8 sat on PyPI for about 40 minutes in March. Find installs, check CI, rotate keys and pin what your AI gateway runs.
·10 min read
Miasma and Phantom Gyp: npm Supply Chain Worm Explained
A self-spreading worm compromised 57 npm packages in under 2 hours using binding.gyp instead of postinstall scripts, bypassing security scanners. What it means for teams that run npm install, and the 5 controls that limit your exposure.
·8 min read
AI Vendor Supply Chain Security Checklist for Small Teams
Respond within 24 hours: AI vendor supply chain security checklist to map exposure, scope access, and contain a contractor breach like Vercel's.
·12 min read
AI Vendor Security Incident Response: A 4-Step Playbook
When your AI vendor has a security incident, your team has hours to respond. Scope, credential rotation, and documentation steps for small teams.