Tag: supply-chain
All the articles with the tag "supply-chain".
-
Weekly Roundup: The Hugging Face reports land, TeamPCP gets arrested
OpenAI and METR published their Hugging Face post-mortems on the same day, Dream's forensics filled in the Taiwan attack, and Australian police charged two men over a year of npm and PyPI worms.
-
TeamPCP's Arrests Don't Recall the Worm
Australian police charged two men in their early twenties as the alleged leaders of TeamPCP, blamed for a year of npm and PyPI supply-chain attacks. The group open-sourced its worm toolkit in May, and someone else was already using it in August.
-
[AUTO] Marimo notebooks execute code just by opening them
Code injection in marimo notebooks runs arbitrary MCP commands on file open, no execution required.
-
[AUTO] MCP's Secret Problem Isn't the Bugs
MCP's blind trust in untrusted server metadata creates an endemic credential exposure problem at scale.