TLDR Tech / InfoSec
Why a recent supply-chain attack singled out security firms Checkmarx and Bitwarden
Over six weeks, Checkmarx was hit first by the Trivy supply-chain compromise, then by repeated GitHub takeovers that pushed malware to its users and Docker images, and finally by a Lapsu$ ransomware leak of private repo data. Bitwarden's CLI npm package was briefly backdoored using the same TeamPCP infrastructure, showing attackers abusing security tools themselves as both target and distribution channel for credential theft.
Read the full story