Topic · 15 stories
15 stories tagged supply-chain on AI Tamer, newest first.
Cursor's extension marketplace served a malicious Claude Code 2.1.313 that added an attacker SSH key and reverse tunnel. What Cursor users should check.
Radware found one-day campaign items in repos such as Trivy, LangExtract and MLflow. Two runs show the injected command executed in GitHub Actions.
In preview for GitHub Enterprise Cloud, it blocks malware, risky versions, new install scripts and too-fresh npm packages before agents or CI install them.
Microsoft says a China-aligned group used ARTEX agents after the ConnectWise Cloud Backup breach, trying 2,250+ Microsoft 365 tenants. What to check.
Poisoned LiteLLM 1.107.0 wheels and images stole cloud, SSH and AI keys, plus provider keys stored in the proxy database. What happened and what to do.
In 90 of 6,637 malicious agent skills, VirusTotal found the payload hidden where reviewers don't see it but agents still read it. Here is how to check.
A FASCSA order excludes DeepSeek from civilian agency purchases and removes its products, plus third-party products developed using DeepSeek implementations.
crates.io listed 127 of 136 zip versions yanked on 16 October. Nine remain, including 8.6.0, which one advisory names.
Two 21 September commits added a loader and a root-level preinstall key to Zod's git repo and were reverted that day. The npm tarballs for zod and @zod/mini 4.6.6 do not contain them.
JFrog rates CVE-2026-105192 at 9.8 for pickle on LMCache's multiprocess ZeroMQ socket when that socket is routable. No release removes the path. Pull request 5644 is open and unmerged.
CloudSEK links seven fake NebulaAI SDK packages on npm, from four burner accounts, to a modified KNTRAT Windows trojan dropped by a preinstall hook. OSV flags api-nebula, llm-nebula and nebula-sdk.
StepSecurity says tensorlake 0.5.144 stole credentials on install and could delete a home directory if the stolen GitHub token was revoked. As of Thursday morning UTC, npm latest is 0.5.143.
GitHub's 30 September 2026 changelog adds an opt-in Allow npm dist-tag permission on trusted publishing, so an OIDC workflow can move latest, next, or beta without a long-lived token. It defaults to off.
A tag like :latest or :2.1 is a name that can be moved to a different image at any time. A digest cannot. What that means for what you run, and how to pin it.
A security alert on a Rust dependency is a lookup, not an alarm. Which four fields to read first, what 'unmaintained' and 'unsound' actually mean, and a short order of response for a Rust AI project.
