Do now Restrict network access to the S7-1500 web server and watch for a Siemens fix. Advisory
Supply chain
The call is coming from inside node_modules. Malicious packages, hijacked maintainers, retargeted tags and poisoned images.
On the counter now 2
-
Siemens SIMATIC S7 PLCs Web Server Vulnerabilities -
LiteLLM Python package LiteLLM Supply Chain Attack Do now Check whether LiteLLM was installed and rotate any credentials it could access. Advisory
What to do
- Check the lockfile, not package.json.The bad version is the one that got installed. Our checker reads lockfiles.
- Pin by hash, not by tag.Commit SHAs for GitHub Actions, digests for container images.
- Rotate what the package could read.CI secrets, registry tokens and cloud keys, if a bad version ran anywhere.
Check a lockfile from your terminal:
curl -sS -F f=@package-lock.json https://pwned.coffee/api/check