A backdoored version of Bitwarden's official CLI was distributed on npm for 93 minutes, stealing GitHub tokens, cloud credentials, and CI/CD secrets. The incident, linked to the Checkmarx campaign, mirrors the Bybit attack path, warning crypto firms about developer machine as new entry points.
Mistral AI and TanStack-related packages were compromised in a large-scale supply chain attack. Researchers say valid SLSA attestations were abused, exposing GitHub tokens, cloud credentials, password vaults, and other sensitive developer secrets across AI and crypto ecosystems.
Mistral AI and TanStack were caught in a major supply chain attack that compromised widely used packages, exposed developer secrets, and undermined trust in SLSA-attested builds across AI and crypto ecosystems.
Mistral AI and TanStack-related packages were compromised in a large supply chain attack affecting PyPI and npm. Researchers said the malware stole GitHub tokens, cloud credentials and password vault data, while some malicious packages even carried valid SLSA provenance.
Mistral AI and TanStack-linked packages were compromised in a major supply chain attack, with malicious releases carrying valid SLSA attestations. The campaign exposed GitHub tokens, cloud credentials and password vaults, raising alarm across AI and crypto development ecosystems.
MoonPay has launched an open-source wallet standard that enables AI agents to hold funds and transact across blockchains, with encrypted local key storage, isolated signing and policy controls. PayPal, OKX and Circle joined the effort.
MoonPay has launched an open-source wallet standard designed to help AI agents hold funds and execute transactions across blockchains, with contributions from firms including PayPal, OKX and Circle.
A coordinated supply chain attack dubbed Mini Shai-Hulud compromised over 170 npm and PyPI packages, impacting TanStack, Mistral AI, UiPath and others. The incident highlights growing risks to Web3 teams relying on automated build and deployment pipelines.
