Skip to content
Braincap
← All articles

Blog

Supply chain

Illustration: a legitimate proc-macro2 package next to the proc-macro1 typosquat, which triggers a build.rs at compile time that leaks data

Rust is memory-safe, not supply-chain-safe: the arrayref case

Three popular Rust crates (arrayref, with 245 million downloads) were poisoned via account takeover and a typosquat, proc-macro1, that ran an infostealer at compile time through build.rs. Rust does not protect you here: memory safety is not supply-chain safety. How it worked and what would have stopped it: cargo-deny, vendoring, offline builds, pinning.

Read the article
Illustration: an employee badge that passes every check, behind which a different operator stands, masked, working remotely

The threat hiding in your hiring process: how fake remote workers get in

Schemes documented by the FBI and DOJ: remote "IT workers" with fake or stolen identities — including North Korean operations — pass your hiring, collect the salary, and sometimes steal data or extort. This is not about suspecting every remote candidate; it is about verifying the human behind the documents and monitoring after the hire. How the scheme works and what defence to build, without paranoia.

Read the article
Illustration of a compromised Xcode project running a script on build and infecting other projects on the system

XCSSET v40: malware for macOS developers, delivered through compromised Xcode projects

A new variant of the XCSSET malware (v40), documented by Palo Alto Networks Unit 42, targets macOS developers: it hides in compromised Xcode projects and GitHub repositories, triggers on build, and propagates to the other projects on the system. New in v40: a Chrome hijacker (via the Chrome DevTools Protocol) and a Telegram trojanizer. How it works, and what to do.

Read the article
Illustration of proprietary knowledge leaving in a person's memory — the one channel that passes through no technical control

The person who leaves takes more than the laptop

What the Apple–OpenAI lawsuit shows about a risk vector nobody monitors: recruiting a key person out of a technology vendor is a supply-chain security event. Six failure modes, the legal distinction between mobility and attack (Romania's OUG 25/2019), the special case of the technology vendor, and what NIS2, DORA, ISO 27001 and GDPR require.

Read the article
Illustration of a community software package taken over by an attacker injecting malicious code into the build file

Arch Linux disabled AUR package adoption to stop a malware flood

Attackers took over 200+ packages in the Arch User Repository (AUR) by adopting orphaned packages and injecting malicious code into build files — an anti-analysis loader plus a Rust infostealer delivered over Tor that steals SSH keys, cloud secrets and API keys. Arch temporarily disabled adoption. How it worked, and the supply-chain lesson.

Read the article
Illustration of a compromised third-party script swapping a crypto wallet address inside a web page

An Adform script was compromised to steal cryptocurrency from the sites that used it

The tracking script of Adform, one of Europe's largest adtech firms, was compromised: malicious code injected into trackpoint-async.js swapped Bitcoin, Ethereum and TRON wallet addresses for the attacker's, right inside the pages loading the script. A textbook client-side supply-chain attack, found by Kevin Beaumont. How it worked, and the lesson.

Read the article
Illustration of a legitimate application loading a malicious plugin

Notepad++ plugins abused to stealthily install malware

The facts on the campaign described by CERT-UA: how attackers abuse the legitimate Notepad++ plugin mechanism (DLL side-loading) to install persistent malware without looking suspicious.

Read the article