153M IDs Leaked & npm's Supply Chain Nightmare Just Got Worse 🚨

Two stories from this week's security news show just how fragile "trust" has become online — trust in the documents that prove who we are, and trust in the code powering the software we all rely on.

153 Million Driver's Licenses Just Turned Up for Sale Online

A dark web marketplace called Nexus was caught selling scans of more than 153 million U.S. and Canadian driver's licenses and other ID documents. Researchers traced the leak back to a breach at an identity-verification vendor used by major companies, and the FBI has now opened a formal investigation — though the site went dark once the story broke. If you've ever scanned your ID to open a bank account, rent a car, or verify your age online, there's a real chance your document is part of this haul. Stolen ID scans are especially valuable to fraudsters because they can be used to open credit lines or pass identity checks in ways a stolen password alone can't. It's a good moment to freeze your credit and stay alert for identity-verification requests you didn't initiate.

Read more

A Worm Called Shai-Hulud Just Proved "Verified" Code Isn't Always Safe

In a recent campaign, attackers hijacked a legitimate developer's own signed release pipeline and pushed malicious versions of over 400 popular open-source packages in under four hours. Because the attackers used the developer's trusted infrastructure, every poisoned package still carried a valid security "stamp of approval" — and the malware hid its instructions inside an Ethereum smart contract to dodge standard blocklists. This matters because nearly every piece of modern software, from banking apps to everyday business tools, is built on open-source packages like these, so a single compromised link can quietly poison thousands of downstream products. It's a reminder that "verified" and "signed" don't automatically mean safe, and that businesses need real oversight of their software supply chain, not just a checkmark.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.