Supply chain compromise
Named by 28 kept items in this workspace.
26 items name it under techniques and 2 under classification.key entities.
Search every workspace for Supply chain compromise. It matches the name as written, so it can find other things that share it.
The items that name it 28
Cited as the ConnectWise incident in which ARTEX was used, according to Microsoft.
A maliciously modified Claude Code extension was distributed under Anthropic's name through Cursor's marketplace for about 11 hours, from 2:27 a.m. to 1:35 p.m. Pacific Time on October 29, exposing up to 5,000 developers
Malicious loader prepended to the legitimate extension bundle, so it runs on extension load before real code; manifest claims publisher Anthropic
Backdoored official Claude Code for VS Code extension bundle on the Cursor Marketplace, with an injected IIFE prepended to extension.js that runs when Node loads the file, before activate.
A third-party provider was compromised and a DebugBear-hosted script carried wallet-draining code into the Polymarket frontend; the page does not state the ATT&CK id
Berri-AI vs BerriAI
Attackers ran LiteLLM's legitimate release pipeline against the lookalike fork Berri-AI/litellm (legitimate fork is BerriAI/litellm) and published malicious wheels and Docker images with seemingly legitimate build provenance
Malware is integrated into the Android device prior to sale, characterizing the campaign as a supply-chain threat.
Malicious extensions distributed via VS Code Marketplace and Open VSX trusted channels
Trojanized Packagist theme packages forked from legitimate OphimCMS/KKPhim projects
Threat actor compromised Packagist developer's GitHub repositories and pushed malicious workflow files synced to package development versions.
Malicious Go module impersonating a legitimate dnsub scanner tool distributed via the Go module proxy.
Malicious NuGet DotnetTool packages published masquerading as game cheats/panels to deliver a downloader chain
Malicious functionality introduced via staged extension updates after initial benign versions were published.
Threat actor compromised Klue (a third-party market intelligence vendor) to reach downstream customers including Huntress, described as a 'security domino effect'.
Attackers compromise open source software components (packages, GitHub Actions) which are then pulled into victim environments via package managers/CI, exfiltrating credentials or executing malicious code (example: malicious-pkg 1.2.3 exfiltrates credentials)
Compromise of a legitimate Laravel package's dev branch on Packagist
Publishing a malicious NuGet package impersonating an official Sicoob SDK, with a clean-source façade GitHub repo differing from the malicious distributed artifact
Typosquatting Chinese .NET libraries via NuGet package impersonation.
All techniques in this workspace.