LEMON BLOG

A new npm supply-chain incident involving packages under Red Hat's @redhat-cloud-services namespace has once again highlighted how attractive developer ecosystems have become to attackers. Instead of going directly after end users, modern threat actors are increasingly targeting the tools, libraries and publishing pipelines that developers trust every day.

GitHub has confirmed a serious internal security incident involving around 3,800 of its own code repositories. According to the company, the breach began after an employee's device was compromised through a malicious Visual Studio Code extension, allowing attackers to steal credentials and gain access to internal GitHub repositories.

ASUS has issued an urgent warning about a serious security issue affecting its ASUS Live Update utility, a tool once widely used to automatically push firmware, BIOS, and driver updates to ASUS laptops and desktops. Security analysts have confirmed that this flaw isn't theoretical — it has been actively exploited in real-world attacks, making it a high-priority concern for anyone who still has the software installed.