git clone && Enjoy Your New Backdoor: The Claude Code Vulnerability Trilogy
Check Point found three ways a malicious repo could own your machine through Claude Code — RCE, MCP abuse, and silent API key theft. All patched, all embarrassing.
#supply-chain
4 transmissions tagged #supply-chain
The Assassin in the Tarball: An Open-Source Tragedy in Three Acts
A suspicious CPU spike, a poisoned release, and a community that caught the blade mid-swing.
Six Months of Chrysalis: How Chinese State Hackers Turned Notepad++ Into a Spy Tool
Lotus Blossom hijacked Notepad++'s update infrastructure for half a year and nobody noticed until a bug fix quietly mentioned 'updater hardening.'
The Polite Emails Before the Knife: XZ and the Tragedy of Trust
A two-year courtship, a backdoor in the wings, and one engineer who heard the orchestra go wrong.