Scan to download
BTC $60,728.37 +2.36%
ETH $1,561.25 +0.67%
BNB $575.29 +2.55%
XRP $1.08 +1.33%
SOL $62.01 +0.06%
TRX $0.3225 +0.88%
DOGE $0.0812 +2.20%
ADA $0.1578 +0.76%
BCH $214.96 +1.62%
LINK $7.35 +2.91%
HYPE $56.91 -1.08%
AAVE $60.69 +1.33%
SUI $0.7123 +5.01%
XLM $0.2063 +8.88%
ZEC $360.02 +13.69%
BTC $60,728.37 +2.36%
ETH $1,561.25 +0.67%
BNB $575.29 +2.55%
XRP $1.08 +1.33%
SOL $62.01 +0.06%
TRX $0.3225 +0.88%
DOGE $0.0812 +2.20%
ADA $0.1578 +0.76%
BCH $214.96 +1.62%
LINK $7.35 +2.91%
HYPE $56.91 -1.08%
AAVE $60.69 +1.33%
SUI $0.7123 +5.01%
XLM $0.2063 +8.88%
ZEC $360.02 +13.69%

ito

Slow Fog: Red Hat cloud service npm package suffers from active supply chain attacks, with stolen credentials found in over 300 GitHub repositories

SlowMist has issued a security alert, detecting an active npm supply chain attack targeting @redhat-cloud-services related packages. Currently, over 31 packages have been confirmed affected, with a weekly download volume of approximately 116,000 times, and stolen credentials exist in more than 300 GitHub repositories. This attack method is highly similar to the previous "Shai-Hulud" npm attack, including credential theft, creation of malicious repositories, and automated secret leakage. New suspicious repositories continue to emerge, indicating that the attack is still ongoing, and developers are still being continuously infected.Potential harms include: theft of GitHub/npm tokens, leakage of AWS/GCP/Azure cloud credentials, collection of SSH keys and Kubernetes secrets, leakage of local environment and wallet data, creation of malicious repositories and persistence operations, and even potentially destructive actions after tokens are revoked. It is recommended to immediately remove or downgrade affected @redhat-cloud-services package versions, conduct a comprehensive audit of CI/CD workflows and dependency installations, rotate all GitHub, npm, cloud service, SSH, and wallet-related keys, retain logs, and rebuild exposed developer machines or Runners from clean images while maintaining a high level of vigilance.

Chainalysis: Compliance baseline in the cryptocurrency industry is tightening, and indirect risk monitoring remains a shortcoming

A recent report from blockchain analysis company Chainalysis points out that compliance standards in the cryptocurrency industry are tightening significantly, with about 47% of organizations entering the market in 2026 having pre-warning standards that can reach the strict levels of the top 10% of the industry in 2020. This indicates that the entire ecosystem is maturing rapidly, with newcomers equipped with more aggressive monitoring measures from the outset.The report shows that companies' "direct monitoring" of funds coming directly from known illegal sources has become consistent and strict, but there is still a significant gap in "indirect monitoring" of funds flowing through intermediary addresses. For example, the indirect risk warning thresholds for categories such as ransomware and fraudulent stores on cryptocurrency trading platforms are often 10 to 100 times higher than direct thresholds. The Chainalysis team points out that this gap between direct and indirect monitoring creates opportunities for illegal actors. Companies that can bridge this gap will not only enhance their regulatory defenses but also distinguish themselves as trustworthy counterparties.The report suggests that this indicates the industry is in a transitional period, having achieved specialization in direct risk management but not yet treating indirect risks with the same rigor. The elevation of industry compliance standards is a response to increasingly stringent regulations and ongoing threats from entities such as North Korean hacker groups. In 2025 alone, hackers linked to North Korea caused approximately $2 billion in cryptocurrency losses.
app_icon
ChainCatcher Building the Web3 world with innovations.