Trivy ecosystem supply chain briefly compromised (github.com)

Screenshot of github.com: Trivy ecosystem supply chain briefly compromised

First screen, captured 7 months ago.

Looks similar

Screenshot of github.com: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware (github.com)

367 points by tosh 1 year ago | 263 comments

GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.

duckdb npm supply-chain-attack malware

Screenshot of github.com: RCE Vulnerability in React and Next.js

RCE Vulnerability in React and Next.js (github.com)

559 points by rayhaanj 10 months ago | 214 comments

GitHub security advisory GHSA-9qr9-h5gf-34mp for a critical (CVSS 10.0) remote code execution vulnerability in React Server Components affecting Next.js, with patched versions listed.

nextjs react-server-components rce vulnerability

Screenshot of people.redhat.com: The Marvin Attack

The Marvin Attack (people.redhat.com)

87 points by hardenedvault 2 years ago | 34 comments

Screenshot of github.com: Malicious litellm_init.pth in litellm 1.82.8 PyPI package – credential stealer

Malicious litellm_init.pth in litellm 1.82.8 PyPI package – credential stealer (github.com)

701 points by theanonymousone 7 months ago | 281 comments

GitHub issue in BerriAI/litellm reporting a malicious litellm_init.pth file in the 1.82.8 PyPI package that steals credentials via a supply chain compromise.

supply-chain-attack pypi litellm python