#javascript
3 cases
Manchester Airports Group Breach: The Iterable Key in the Front-End JavaScript Since 2023Data BreachExtortion & Blackmail
FulcrumSec took 8.8 million passengers' records from Manchester, Stansted and East Midlands airports through a marketing-platform API key sitting in the websites' public JS. Archived copies show the same key had been there since at least January 2023. MAG refused the ransom; 550 GB was published.
Data BreachExtortion & Blackmail
Polyfill.io: How a CDN Acquisition Backdoored Hundreds of Thousands of SitesFinancial FraudSupply Chain Attack
Nobody was hacked. A Chinese CDN company bought the polyfill.io domain, and every site that had ever pasted the script tag started serving whatever the new owner wanted. Four months later it was redirecting phones to betting scams.
Financial FraudSupply Chain Attack
event-stream: The npm Maintainer Handover That Backdoored a Bitcoin WalletSupply Chain AttackCryptocurrency & Web3
A stranger emailed an unpaid maintainer offering to take over a package he no longer used. Three months later it was stealing private keys from bitcoin wallets holding more than 100 BTC. Nobody was ever identified.
Supply Chain AttackCryptocurrency & Web3