Bitwarden CLI npm package compromised to steal developer credentials
The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing
CYBERSECURITY INTELLIGENCE
News that matters, without the noise.
Search current cybersecurity reporting locally in this app. Search terms are not sent to AdvisoryLoom. The Professional plan adds Watchlists, structured My Intelligence, and AI briefings.
Private search: the term stays in this browser and is matched against a generic content feed.LATEST COVERAGE
Cyber News
AI-Assisted Lazarus Campaign Targets Developers With Backdoored Coding Challenges
A North Korean state-sponsored threat group is running an active campaign that tricks software developers into installing malware
Trigona ransomware attacks use custom exfiltration tool to steal data
Recently observed Trigona ransomware attacks are using a custom, command-line tool to steal data from compromised environments faster
Google Favors General‑Purpose Gemini Models Over Cybersecurity‑Specific AI
Google Cloud’s COO advocated for combining general-purpose frontier large language models with task-specific AI agents
Bitwarden CLI Compromised in Supply Chain Attack via GitHub Actions
Socket has confirmed that Bitwarden CLI version 2026.4.0 was compromised as part of the ongoing Checkmarx supply chain
New Checkmarx supply-chain breach affects KICS analysis tool
Hackers have compromised Docker images, VSCode and Open VSX extensions for the Checkmarx KICS analysis tool to harvest
GitHub security advisory (AV26-383)
<article data-history-node-id="7594" about="/en/alerts-advisories/github-security-advisory-av26-383" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder
Cloudsmith Raises $72 Million in Series C Funding
The company will use the investment to accelerate product development and grow go-to-market efforts. The post Cloudsmith Raises
Google Chrome security advisory (AV26-382)
<article data-history-node-id="7593" about="/en/alerts-advisories/google-chrome-security-advisory-av26-382" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder
Vercel says some of its customers’ data was stolen prior to its recent hack
The app and website hosting company has found evidence of a second compromise of customer accounts after expanding
Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia
The threat actor gave itself plenty of options to support command and control, tapping Microsoft Outlook, Slack, Discord,
Bad Memories Still Haunt AI Agents
Cisco found and fixed a significant vulnerability in the way Anthropic handles memories, but experts warn that mishandled