TeamPCP has partnered with ransomware group Vect after exfiltrating ~300GB of credentials from CI/CD environments, targeting open source supply chains.
“We will chain these compromises into devastating follow-on ransomware campaigns.”
Details → socket.dev/blog/teampcp...
This kind of attack is getting more and more common.
Early in my career I used to update dependencies blindly — not anymore. For a few years now I’ve been locking packages to specific versions, reading changelogs carefully, and setting a `cooldown` in Dependabot (link in thread).
