Supply Chain

Malware

101 Malicious npm Packages Secretly Add Developers to WhatsApp Groups

Researchers uncover 101 malicious npm packages in the PhantomSub campaign that abuse authenticated WhatsApp sessions to secretly add developers to attacker-controlled groups and channels.

Zentrya One Desk 5d ago 3 min read

Malware

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Researchers uncover malicious Terraform providers and Go modules delivering Graphalgo-linked Go malware using Slack and Ethereum blockchain infrastructure for command and control.

Zentrya One Desk 26 Sept 2026 3 min read

Vulnerabilities

Leaked GitLab Issue Email Address Can Let Attackers Push Code and Run CI Jobs

A leaked GitLab incoming email address can let attackers impersonate users, push code to permitted branches and trigger CI/CD pipelines without passing normal 2FA or IP restrictions.

Zentrya One Desk 26 Sept 2026 3 min read