🏷️ supply-chain-security

3 articles tagged supply-chain-security.

TrapDoor: The Supply Chain Attack Targeting AI Developers That's Stealing Cloud Keys and SSH Credentials

TrapDoor: The Supply Chain Attack Targeting AI Developers That's Stealing Cloud Keys and SSH Credentials

The TrapDoor supply chain campaign, active as of May 22, 2026, is targeting AI developer communities through malicious packages in public repositories. The packages use preinstall scripts to steal cloud credentials, SSH keys, and developer secrets, then exfiltrate them through GitHub-based command and control infrastructure. The campaign is specifically targeting the tooling and repositories used by AI development teams — a population with access to cloud environments, model infrastructure, and enterprise data pipelines.

 Vercel Got Hacked Through an AI Tool's OAuth Token — Every Enterprise Using Third-Party AI Has This Problem

Vercel Got Hacked Through an AI Tool's OAuth Token — Every Enterprise Using Third-Party AI Has This Problem

Attackers breached Vercel by compromising Context.ai's Google Workspace OAuth application, stealing an employee's credentials and accessing customer data. The attack vector — a trusted third-party AI tool with OAuth access to enterprise systems — is present in thousands of organizations.

 North Korea Backdoored axios — 100 Million Projects Didn't Notice for 39 Minutes

North Korea Backdoored axios — 100 Million Projects Didn't Notice for 39 Minutes

North Korean threat actors compromised the axios npm package — used in 100 million JavaScript projects weekly — through a hijacked maintainer account, delivering a cross-platform RAT in under an hour. For IoT and embedded device builders, it's a wake-up call about firmware supply chain risk.

← All topics

Ask Sage 🤖