TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious ...
TeamPCP’s Mini Shai-Hulud campaign used hijacked GitHub OIDC tokens to spread a credential-stealing worm through TanStack npm ...
I started this as a side project, but my Windows Command Center suddenly became useful.
What happened?: Attackers exploited a CMS flaw to replace JDownloader’s Windows and Linux installers with malware between May 6–7, 2026. What was affected?: Only Windows and Linux shell installers ...
Four supply-chain attacks hit OpenAI, Anthropic, and Meta in 50 days — none inside the model. A 7-row matrix maps what AI ...
China-linked Salt Typhoon and Twill Typhoon were seen expanding their target list and updating their arsenal in recent ...
Japan's Inpex to buy stake in Australian Browse gas field from PetroChina Japan's Inpex said on Friday it would buy PetroChina's 10% stake in the Browse gas fields offshore from Western Australia, the ...
John Hammond is a Security Researcher at Huntress as well as a cybersecurity instructor, developer, red teamer, and CTF enthusiast. John is a former Department of Defense Cyber Training Academy ...
A script is just a collection of commands saved into a text file (using the special .ps1 extension) that PowerShell understands and executes in sequence to perform different actions. In this post, we ...
Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused ...