Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The software supply chain has come under assault once again with the resurgence of the Shai-Hulud npm worm—now significantly more advanced, more destructive, and far more widespread. Consequently, what is quickly being described as one of the most serious active threats to the npm ecosystem, the second wave of the Shai-Hulud campaign has compromised at least 600 npm packages, collectively downloaded more than 100 million times. One of the most alarming aspects of this campaign is its origin point.

At a Glance: Effective Ransomware Defense for MSPs To effectively detect and stop modern ransomware, Managed Service Providers (MSPs) must evolve beyond traditional antivirus to AI-driven Endpoint Detection and Response (EDR). This article details the five stages of a ransomware infection—from initial delivery to extortion—and provides a comprehensive guide on halting them. Core concepts covered include.

Black Friday is one of the most demanding seasons for the retail sector. Massive spikes in online traffic, aggressive promotions, and pressure to keep services available significantly increase the risk of an attack. Cybercriminals are aware of this and exploit the saturation to launch ransomware campaigns, phishing attempts, and supply chain attacks that aim to disrupt operations, steal sensitive data, and cause maximum impact.

Spyware can be a user’s nemesis. Once a user’s device is infected, spyware can collect a variety of personal and sensitive information, depending on the type of spyware. Here is what you need to know about spyware and how to detect it.

On November 24, a new wave of the Shai-Hulud supply chain attack emerged. The threat actors exfiltrate stolen credentials directly to GitHub repositories created with compromised tokens.

Once again, the npm supply chain has been compromised, putting developers relying on these vital open source components at risk. On November 24th, a sophisticated attack that borrows techniques from the Shai-Hulud malware used in the npm hijacking this past September was discovered. This is not an isolated incident. It’s a continuation of an existing campaign that is now abusing CI/CD pipelines, and GitHub automation to spread faster and steal more secrets than before.