SAP Under Siege, GitHub OAuth Hijacking, and npm Supply Chain Hits

News

CISA Alerts on Actively Exploited SAP NetWeaver Vulnerability

CISA added CVE-2025-31324 to their known exploited list, a critical SAP NetWeaver flaw being actively targeted by Chinese state actors. If you run SAP in your environment, patching should be priority zero right now.

Gitloker Abuses GitHub Notifications to Push Malicious OAuth Apps

Attackers are abusing GitHub's notification system to swap PR links with links to malicious OAuth apps. It's a clever social engineering play that bypasses standard repo security controls, so audit your installed integrations.

Malicious npm Packages Infect Over 3,200 Developers

Over 3,200 users got hit by a login typosquatting attack on npm. It highlights the persistent fragility of package registries, so lock your dependencies and scope your tokens.

Chinese APTs Exploit Critical SAP NetWeaver Vulnerabilities

Chinese groups are actively exploiting critical vulnerabilities in SAP NetWeaver to compromise enterprise networks. This is a direct espionage play against high-value corporate data, so get those patches deployed.

Tools

TruffleHog Releases New Secret Scanner Capabilities

TruffleHog dropped a fresh release with expanded secret detection capabilities. Critical tooling for anyone maintaining CI/CD pipelines or cleaning up a messy commit history.

CISA Malcolm Network Analysis Framework Updates to v25.05.0

CISA's network traffic analysis tool, Malcolm, hit v25.05.0. If you're building out detection infrastructure for non-corporate environments, this is worth integrating.