Package ecosystems, build pipelines, SBOMs and signing.
Google Threat Intelligence disrupted the XCPE botnet operating on over 1.3 million Android TV set-top boxes. The operation uncovered pre-installed OEM backdoors that bypassed certification via post-boot payloads.
A tampered build of the Claude Code extension deployed an automated SSH backdoor and persistence mechanisms to up to 5,000 developer workstations.
A supply-chain compromise of Anthropic's official extension on Cursor exposed up to 5,000 developer environments to reverse SSH backdoors and environment credential harvesting.