Topics
supply-chain
Claude Code's Saved Approvals Leak Passwords and API Keys into Public GitHub Repos
A scan of public GitHub found 1,122 copies of Claude Code's saved-approval file holding real secrets — database passwords, SSH logins, CI tokens; rotate every credential before cleaning history.
Attacker Used Qubole's AWS Credentials to Assume Customer Integration Roles and Steal Data
Wiz says a threat actor spent two October weeks assuming customers' Qubole-integration IAM roles from Qubole's own AWS account, harvesting secrets and draining S3; runners should check CloudTrail back to October 1.
Ethersphere Supply Chain Compromise: Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2
A supply-chain attack hit Ethersphere’s own release pipeline: malicious bee-js 13.3.0 on npm and Swarm Desktop 0.56.2 carry a loader that steals Swarm node wallet keys and installs persistence on Linux, macOS and Windows.
Binance Breach: $6.3 Billion — the Largest Crypto Theft on Record
Attackers made off with roughly $6.3 billion in a breach Binance says started with fake job interviews and call-related malware aimed at the exchange's own engineers — the largest crypto theft to date.
New Technique to Trick Developers Detected in an Open Source Supply Chain Attack
Cybercriminals were discovered cleverly manipulating GitHub's search functionality and using meticulously crafted repositories to distribute malware.