Developer Supply-Chain Attacks
Trust broken across the developer toolchain
By the numbers
monthly installs the compromised package had reached
known targets hit by supply-chain compromises
Attack length
3 supply-chain incidents noted in the wave of compromises
A wave of supply-chain compromises this week hit developer tools and packages, leaking credentials and slipping backdoors into trusted binaries. The hits on widely used apps and security vendors forced emergency responses and raised fresh questions about how software is built and distributed.
Articles & Coverage
Chaos erupts as cyberattack disrupts learning platform Canvas amid finals
Biz & IT - Ars Technica · May 8
Mozilla says 271 vulnerabilities found by Mythos have "almost no false positives"
Biz & IT - Ars Technica · May 7
Ars Asks: Share your shell and show us your tricked-out terminals!
Biz & IT - Ars Technica · May 6
Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack
Biz & IT - Ars Technica · May 5
Why Reddit blocked my daily visit to its mobile website
Biz & IT - Ars Technica · May 5
GameStop offers $56 billion for eBay, struggles to explain how it'll pay for it
Biz & IT - Ars Technica · May 4