YEARLONG SUPPLY-CHAIN ATTACK TARGETING SECURITY PROS STEALS 390K CREDENTIALS

Summary from the TLDR InfoSec newsletter

A sophisticated supply-chain attack has been targeting security and technical personnel for a year using Trojanized open-source software from GitHub and NPM to steal login credentials. The campaign employs infected packages and spear phishing techniques to infiltrate researchers' devices with a stealthy backdoor.