#code-signing
2 cases
Codecov Bash Uploader Compromise: 60 Days of Silent CI Credential TheftSupply Chain Attack
A credential left in a Docker image layer let an unidentified attacker rewrite Codecov's Bash Uploader and harvest every secret from its customers' CI environments for sixty days. No one was ever identified.
Supply Chain Attack
3CX Supply Chain Attack (CVE-2023-29059): The First Cascading Software CompromiseSupply Chain AttackState-Sponsored
A North Korean-linked actor compromised Trading Technologies' X_TRADER, used it to breach 3CX, and shipped signed, trojanised VoIP clients to its customers — the first documented case of one software supply chain attack causing another.
Supply Chain AttackState-Sponsored