T1195.002Initial Access
Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may…
CVEs10
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.10
Reports1
Detections
17 Sigma rules tagged T1195.002Compromise Software Supply ChainT1195.00217 general rules
- Axios NPM Compromise File Creation Indicators - Linuxhighexperimental
- Axios NPM Compromise File Creation Indicators - MacOShighexperimental
- Axios NPM Compromise File Creation Indicators - Windowshighexperimental
- Axios NPM Compromise Indicators - Linuxhighexperimental
- Axios NPM Compromise Indicators - macOShighexperimental
- Axios NPM Compromise Indicators - Windowshighexperimental
- LiteLLM / TeamPCP Supply Chain Attack Indicatorshighexperimental
- Shai-Hulud 2.0 Malicious NPM Package Installationhighexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Compromise Software Supply Chain
10 CVEs, by priority. Each link shows its badge.- CVE-2026-45321TanStack Unspecified VulnerabilityTanStack · TanStackKEVRansomwarePublic exploitCritical · 9.6T1195.002Compromise Software Supply ChainT1528Steal Application Access Token1 reportAI mapping from the description · how it is exploited3.3%Top 12%86.3priority
- CVE-2026-48027Nx Console Embedded Malicious Code VulnerabilityNx · Nx ConsoleKEVRansomwarePublic exploitCritical · 9.8T1195.002Compromise Software Supply ChainT1059Command and Scripting Interpreter1 reportAI mapping from the description · how it is exploited1.8%Top 21%84.5priority
- CVE-2026-33634Aquasecurity Trivy Embedded Malicious Code VulnerabilityAquasecurity · TrivyKEVPublic exploitHigh · 8.8T1195.002Compromise Software Supply ChainT1552.001Credentials In Files2 reportsAI mapping from the description · how it is exploited59.7%Top 0.87%80.1priority
- CVE-2021-44529Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection VulnerabilityIvanti · Endpoint Manager Cloud Service Appliance (EPM CSA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1195.002Compromise Software Supply ChainMITRE CTID mapping of the KEV entry · primary impact99.1%Top 0.07%79.8priority
- CVE-2026-8398Daemon Tools Lite Embedded Malicious Code VulnerabilityDaemon · Daemon Tools LiteKEVPublic exploitCritical · 9.8T1195.002Compromise Software Supply ChainT1553.002Code SigningAI mapping from the description · how it is exploited1.5%Top 27%69.6priority
- CVE-2025-30066tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerabilitytj-actions · changed-files GitHub ActionKEVPublic exploitHigh · 8.6T1195.002Compromise Software Supply ChainT1552.001Credentials In FilesAI mapping from the description · how it is exploited72.1%Top 0.57%68.9priority
- CVE-2024-4978Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code VulnerabilityJustice AV Solutions · Viewer KEVPublic exploitHigh · 8.4T1195.002Compromise Software Supply ChainT1005Data from Local System+2 moreMITRE CTID mapping of the KEV entry · how it is exploited26.9%Top 2%68.5priority
- CVE-2025-54313Prettier eslint-config-prettier Embedded Malicious Code VulnerabilityPrettier · eslint-config-prettierKEVPublic exploitHigh · 7.5T1195.002Compromise Software Supply ChainT1059Command and Scripting InterpreterAI mapping from the description · how it is exploited5.1%Top 7.6%66.7priority
- CVE-2025-30154reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerabilityreviewdog · action-setup GitHub ActionKEVPublic exploitHigh · 8.6T1195.002Compromise Software Supply ChainT1552.001Credentials In FilesAI mapping from the description · how it is exploited2.5%Top 15%65.9priority
- CVE-2025-59374ASUS Live Update Embedded Malicious Code VulnerabilityASUS · Live UpdateKEVCritical · 9.8T1195.002Compromise Software Supply ChainT1059Command and Scripting InterpreterAI mapping from the description · how it is exploited1.2%Top 32%63.5priority