Supply Chain Attacks Surge, Infostealers Target Developers, and Nation-State Espionage Expands

News

Malicious npm Packages Compromise 3,200+ Cursor Users via Fake AI Extensions

Attackers published convincing fake Cursor AI packages to npm that silently exfiltrated credentials and project files from developer machines. If you install npm packages without auditing them first, your dev environment is the attack surface now.

Chinese APT Exploits SAP NetWeaver Zero-Day to Hit Critical Infrastructure

A Chinese nation-state group is actively exploiting an unpatched SAP NetWeaver flaw to get persistence inside energy and manufacturing targets. SAP environments are notoriously slow to patch, which makes this a high-priority exposure for any org running that stack.

GitLoker Campaign Abuses GitHub Notifications to Push Malicious OAuth Apps

Attackers are sending spoofed GitHub notification emails that trick developers into authorizing rogue OAuth apps, handing over repo access in one click. OAuth abuse is increasingly the low-friction path into developer toolchains and this campaign is a clean example of why you should audit your authorized apps right now.

CISA Adds Three New Actively Exploited Vulnerabilities to KEV Catalog

CISA added three new CVEs to the Known Exploited Vulnerabilities catalog, including flaws in widely deployed enterprise software with active exploitation confirmed in the wild. If you are in federal or critical infrastructure, these are mandatory remediation items with tight deadlines.

Tools

TruffleHog Releases Updated Secret Scanning Rules for New Cloud Services

TruffleHog pushed new detection rules covering secrets for additional cloud providers and SaaS platforms, expanding coverage for teams doing pre-commit or CI-level secret scanning. Worth pulling the latest version if you are relying on this for pipeline security gates.