Supply_chain_attack

Google confirms data from 200+ Salesforce instances was accessed via a Gainsight breach, tied to the Scattered Lapsus$ Hunters, with multiple affected vendors and ongoing investigations.

A multi-stage supply-chain attack cascaded through npm → Rust → Python tooling, compromising millions and triggering a formal CVE with ongoing regulatory classification debates.

Two malicious Axios releases were briefly published on npm due to a compromised maintainer account, introducing a remote-access trojan via plain-crypto-js; remediation focuses on OIDC-based publishing, immutable releases, CI publishing, and credential hygiene.