Google GTIG Warns of Growing OSS Supply Chain Attacks Targeting Dev Credentials

·1 views

Google's Threat Intelligence Group (GTIG) published guidance on July 30, 2026, detailing a surge in open-source supply chain attacks targeting developers, maintainers, and CI/CD pipelines. Threat actors including UNC6780 and MIDNIGHT NEPTUNE are stealing credentials via social engineering and abusing GitHub Actions permissions to inject malicious code into legitimate packages on npm, PyPI, and Docker Hub. In one documented case, attackers added malicious dependencies to the widely used axios package, deploying the WAVESHAPER.V2 backdoor and impacting users across 13 countries and 15 industries. Credential-stealing tools like SANDCLOCK enable attackers to self-propagate compromises across repositories and pivot into broader enterprise cloud environments. GTIG recommends phishing-resistant MFA, short-lived OIDC tokens, pinned dependencies with provenance verification, and strict egress controls to reduce exposure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

California aquifer may be irreversibly depleted, scientists warn

A California aquifer may have reached a critical threshold beyond which recovery is no longer possible, according to new research. The findings raise serious concerns about long-term water availability in a state that heavily relies on groundwater for agriculture and drinking supplies. Scientists suggest the aquifer's depletion has progressed to a point where natural recharge cannot keep pace with extraction. The situation underscores growing warnings about unsustainable groundwater use across drought-prone regions of the American West.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Why NVIDIA Open-Sourced Its Linux GPU Kernel Modules: Architecture, Not Just Policy

NVIDIA released GPL-licensed Linux kernel modules — including nvidia.ko, nvidia-drm.ko, nvidia-uvm.ko, and nvidia-modeset.ko — while keeping user-space components like CUDA, OpenGL, and GSP firmware proprietary. The move was enabled by the introduction of the GPU System Processor (GSP), which shifted low-level hardware control from the host CPU's kernel driver into onboard firmware, allowing the kernel-facing interface to be safely open-sourced. Previously, NVIDIA's proprietary modules required a DKMS-based workflow that frequently broke after kernel updates and caused Secure Boot and packaging difficulties for Linux distributions. With source code now available, major distros such as Ubuntu, Red Hat, and SUSE can integrate, sign, and maintain the modules within their own infrastructure far more easily. NVIDIA also highlights improved debuggability, security review, and compatibility with modern environments like Kubernetes clusters, AI training servers, and Confidential Computing platforms as key benefits of the change.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Enterprises Can Build Audit and Observability Stacks for AI Agents

As autonomous AI agents take on complex, multi-step business tasks across databases and APIs, traditional monitoring tools are proving inadequate for diagnosing failures or hallucinations. Enterprise security, audit, and regulatory teams now require verifiable, non-repudiable records of every agent execution to comply with frameworks such as SOC 2, FedRAMP, and the EU AI Act. Platform engineering teams are being urged to adopt an Audit, Observability, and Lineage architecture built on OpenTelemetry, OWASP Agent Observability Standards, and immutable lineage graphs. This approach encapsulates each agent run within a traceable root context, recording sub-tasks, tool calls, and model invocations as hierarchical spans with standardized metadata. To manage the high data volumes generated, the architecture applies tail sampling — retaining all error and anomaly traces while downsampling routine successful runs to reduce storage costs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Chaos Ransomware Deployed in Under 17 Hours via Microsoft Teams IT Support Scam

Cybersecurity firm Sophos has detailed a threat cluster, tracked as STAC4749, in which attackers impersonate IT support staff using external Microsoft Teams accounts to trick employees into granting remote access. The attacker initiates contact from a Teams account on a deceptive .top domain, then uses legitimate remote tools like Quick Assist and RemSupp to establish control over the victim's device. Once inside, they deploy PowerShell scripts, a PyArmor-obfuscated PyInstaller backdoor, multiple remote management tools, and a reverse SOCKS proxy to move laterally across the internal network. In at least one confirmed case, the attackers exfiltrated data before simultaneously encrypting multiple devices with Chaos ransomware, completing the entire attack in under 17 hours. Sophos recommends restricting external Teams communications, enforcing strict application controls, and training users to verify IT staff identity before approving any remote support session.

0 comments Read more at DEV Community