As supply-chain attacks against widely-used, open-source software repositories continue, experts are urging developers to not ...

The Bitwarden CLI NPM package compromise is tied to a Checkmarx supply chain attack and references the Shai-Hulud worm.

The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other projects.

Hackers have compromised Docker images, VSCode and Open VSX extensions for the Checkmarx KICS analysis tool to harvest ...

Bitwarden CLI 2026.4.0 was compromised via GitHub Actions in Checkmarx campaign, exposing secrets and distributing malicious ...

Malicious KICS Docker tags and VS Code versions 1.17.0, 1.19.0 enabled data exfiltration, risking exposed infrastructure ...

Fake packages aim to steal data, credentials, and secrets, and to infect every package created using them, in what could be ...

Browser extensions are mostly harmless, but unfortunately, these Chrome extensions are the opposite and pose imminent risk to ...

The extensions are capable of stealing Google account information and other data, including messages, contacts, and linked ...

Researchers linked 108 malicious Chrome extensions to a coordinated campaign that exposed about 20,000 users to data theft, ...

All 108 route stolen credentials, user identities, and browsing data to servers controlled by the same operator," Security Researcher Kush Pandya said in an analysis ...

Over 100 Chrome extensions sharing C&C infrastructure were seen stealing user data, injecting ads, and containing a backdoor.