Do not get high(jacked) off your own supply (chain)
Summary: Cisco Talos reports a recent wave of supply chain attacks, including malicious modification of the Axios JavaScript HTTP client library and TeamPCP's injection of malicious code into hijacked GitHub repositories for open-source projects such as the Trivy security scanner. Axios receives 100 million downloads weekly, and Talos's 2025 Year in Review found nearly 25% of the top 100 targeted vulnerabilities affect widely used frameworks and libraries, with the React2Shell vulnerability in React Server Components becoming the top-targeted vulnerability of 2025 despite being disclosed in December.
Key Takeaway: A tool like Trivy, used to scan for supply chain vulnerabilities, was itself compromised, and a vulnerability disclosed in December became the year's most targeted - so the scanner and the calendar are no longer reliable lines of defense. Talos attributes follow-on attacks ranging from ransomware to espionage to adversaries spanning state-sponsored groups and teenage cyber criminals.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026