CrowdStrike describes stolen maintainer credentials used to compromise Axios on npm. blackorbird ties a Lazarus campaign to a single npm package, and Unit 42 and Gameel Ali discuss TeamPCP supply chain compromises and tooling used after a package compromise.
used stolen maintainer credentials to compromise the widely used HTTP client library Axios
A single NPM package that led us to the Lazarus Groups latest campaign
#TeamPCP was caught using #AdaptixC2 after compromising a package.
TeamPCP’s supply chain attacks continue
This finding is one of many signals tracked across Cyber Security. The live feed updates every few hours with new expert voices, debates, and emerging ideas.
← Back to Cyber Security