docs: add 2025 software supply chain compromises to catalog

community/catalog/compromises/2003/gentoo-rsync.md

@@ -16,4 +16,4 @@ responsible for serving package sources to users.
 
 ## References
 
-- https://archives.gentoo.org/gentoo-announce/message/7b0581416ddd91522c14513cb789f17a
+- [Gentoo Linux server compromised](https://www.zdnet.com/article/gentoo-linux-server-compromised/)

community/catalog/compromises/2025/changed-files.md

@@ -0,0 +1,36 @@
+<!-- cSpell:ignore exfiltrated GHSA mrrh -->
+
+# tj-actions/changed-files GitHub Action Compromise
+
+In March 2025, attackers compromised the popular GitHub Action
+`tj-actions/changed-files`, used by over 20,000 repositories to detect file
+changes in pull requests.
+
+The threat actor compromised a maintainer's credentials to manipulate Git tags,
+redirecting trusted version references to a malicious commit that executed code
+during CI/CD workflows.
+
+The injected code captured environment variables and exfiltrated secrets such as
+GitHub tokens and API credentials to an external server. This compromise
+propagated silently through automated pipelines, as many users relied on mutable
+version tags (e.g., v35, v36) instead of immutable commit SHAs, meaning their
+workflows automatically pulled and executed the malicious code.
+
+## Impact
+
+This compromise had multiple implications across the GitHub Actions ecosystem
+as thousands of repositories were possibly exposed through automate workflows,
+any CI/CD runner secrets, repository tokens or organization credentials were
+potentially at risk, and overall demonstrated how a single third-party action
+could become a high-impact attack vector within trusted build automation
+pipelines.
+
+## Type of Compromise
+
+This is a _Publishing Infrastructure_ type of attack as the attacker targeted a
+GitHub action which is part of the CI/CD and build automation layer.
+
+## References
+
+- [GitHub Advisory Database - GHSA-mrrh-fwg8-r2c3](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3/)
+- [Wiz.io – GitHub Action tj-actions/changed-files Supply Chain Attack (CVE-2025-30066)](https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066)

community/catalog/compromises/2025/ghost-action.md

@@ -0,0 +1,30 @@
+# The GhostAction Github Workflow Injection
+
+In September 2025, GitGuardian discovered GhostAction campaign, a large-scale
+supply chain campaign in which attackers compromised 327 GitHub user accounts
+and injected malicious workflows into 817 repositories, stealing a total of 3,325
+secrets. The malicious workflows, often titled "Github Actions Security",
+were engineered to enumerate known secret names from legitimate workflow files
+(e.g. PyPI tokens, npm tokens, DockerHub, AWS keys) and exfiltrate them via HTTP
+POST to attacker-controlled endpoints.
+
+## Impact
+
+The GhostAction campaign compromised the trust and integrity of GitHub's
+publishing pipelines, exposing sensitive credentials from hundreds of
+open-source projects. The stolen secrets, including registry tokens and cloud
+provider keys, could enable attackers to publish malicious packages, access
+private infrastructure, or escalate to broader supply chain compromises across
+ecosystems like npm, PyPI, and DockerHub. This incident highlights how
+manipulating CI/CD workflows can undermine the integrity of the entire
+open-source distribution chain.
+
+## Type of Compromise
+
+This compromise falls under the _Malicious Maintainer_ category, as the attackers
+gained access to legitimate GitHub maintainer accounts and leveraged their
+privileges to inject malicious workflow code.
+
+## References
+
+- [The GhostAction Campaign: 3,325 Secrets Stolen Through Compromised GitHub Workflows](https://blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen)

community/catalog/compromises/2025/npm-ecosystem.md

@@ -0,0 +1,36 @@
+<!-- cSpell:ignore Shai Hulud Shai hulud Shai-Hulud -->
+
+# Widespread npm Ecosystem Compromise
+
+The Widespread npm Ecosystem Compromise, which began around September 8, 2025,
+was a multi-phased incident. The initial phase involved a phishing campaign that
+compromised maintainer accounts, leading to the injection of a
+cryptocurrency-stealing payload into dozens of popular packages (like chalk and
+debug). This was quickly followed by the discovery of the "Shai-Hulud" worm
+campaign, which used a self-propagating credential-stealing malware to
+compromise over 500 npm packages.
+
+## Impact
+
+The compromise resulted in a widespread infection across the npm ecosystem,
+affecting hundreds of packages and potentially thousands of downstream
+applications that automatically pulled malicious versions. The injected payloads
+enabled credential theft, unauthorized command execution, and persistent access
+within both developer and CI/CD environments.
+
+## Type of Compromise
+
+The npm ecosystem is a _Malicious Maintainer_ type of attack as the attackers
+managed to gain control of npm maintainer accounts and used their privileges to
+push malicious versions of legitimate packages.
+
+## References
+
+- [Breakdown: Widespread npm Supply Chain Attack Puts Billions of Weekly Downloads at Risk](https://www.paloaltonetworks.com/blog/cloud-security/npm-supply-chain-attack/)
+- [Ongoing Supply Chain Attack Involving npm Packages](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-093)
+- [Shai-hulud supply chain attack spreads token-stealing malware on npm](https://www.reversinglabs.com/blog/shai-hulud-worm-npm)
+- [npm Chalk and Debug Packages Hit in Software Supply Chain Attack](https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack)
+- [Another npm Supply Chain Attack: The 'is' Package Compromise](https://www.stepsecurity.io/blog/another-npm-supply-chain-attack-the-is-package-compromise)
+- ["Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated September 23)](https://unit42.paloaltonetworks.com/npm-supply-chain-attack)
+- ["Massive npm infection: the Shai-Hulud worm and patient zero"](https://securelist.com/shai-hulud-worm-infects-500-npm-packages-in-a-supply-chain-attack/117547)
+- [What We Know About the NPM Supply Chain Attack](https://www.trendmicro.com/en_us/research/25/i/npm-supply-chain-attack.html)

community/catalog/compromises/2025/nx-platform.md

@@ -0,0 +1,37 @@
+<!-- cSpell:ignore ngularity exfiltrated -->
+
+# The Nx s1ngularity Attack Leading to Credentials Leak
+
+On August 26, 2025, attackers released malicious versions of the nx and @nx/*
+npm packages (versions 20.9.0 through 21.8.0). The trojanized packages contained
+credential-harvesting malware that scanned each developer system for sensitive
+artifacts: GitHub tokens, npm keys, SSH private keys, environment variables,
+cryptocurrency wallet files, and AI tool configurations. The malware exfiltrated
+stolen credentials via double Base64 encoding and published them to over 1,400
+public GitHub repositories, each named in a "s1ngularity-repository-*" pattern
+with a single `results.b64` file containing encoded data.
+
+## Impact
+
+The Nx s1ngularity attack had an extensive impact across the open-source and
+enterprise ecosystem. In total, over 20,000 files were exfiltrated, affecting
+more than 1,700 users worldwide. The attackers leveraged stolen credentials to
+make at least 6,700 private GitHub repositories public, exposing sensitive
+source code, proprietary configurations, and credentials — some belonging to
+major organizations and high-profile projects. This extensive exposure
+underscored the cascading risk of software supply chain compromises, where a
+single poisoned package can rapidly undermine trust and security across
+thousands of interconnected development environments.
+
+## Type of Compromise
+
+This is an _Attack Chaining_ type of compromise with elements of _Dev Tooling_
+and _Malicious Maintainer_, as the attackers initially leveraged compromised CI
+workflows, published infected Nx packages, and chained the attack to expose
+thousands of private repositories across the ecosystem.
+
+## References
+
+- [The Nx "s1ngularity" Attack: Inside the Credential Leak](https://blog.gitguardian.com/the-nx-s1ngularity-attack-inside-the-credential-leak/)
+- [s1ngularity Nx Supply Chain Attack: AI-Driven Credential Theft & Mass Exposure](https://hivepro.com/threat-advisory/s1ngularity-nx-supply-chain-attack-ai-driven-credential-theft-mass-exposure/)
+- [s1ngularity: Popular Nx Build System Package Compromised with Data-Stealing Malware](https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware)

community/catalog/compromises/2025/oracle-cloud.md

@@ -0,0 +1,43 @@
+<!-- cSpell:ignore Exfiltrated exfiltrated -->
+
+# Oracle Cloud SSO and Identity Infrastructure Compromise
+
+The Oracle Cloud data breach, publicly disclosed around March 21, 2025, involved
+a large-scale compromise of authentication and identity management systems. A
+threat actor operating under the alias "rose87168" announced on the black-hat
+forum BreachForums that they had exfiltrated a significant number of records
+from Oracle Cloud's federated Single Sign-On (SSO) login servers and Lightweight
+Directory Access Protocol (LDAP) systems.
+
+The attacker claimed the initial infiltration occurred around mid-February 2025,
+possibly exploiting a vulnerability in an older, unpatched component of the
+infrastructure, such as Oracle Fusion Middleware 11G or a critical flaw in
+Oracle Access Manager (potentially related to CVE-2021-35587). The compromise is
+generally believed to have affected legacy Gen 1 servers and not the primary
+Oracle Cloud Infrastructure (OCI) Gen 2 environment.
+
+## Impact
+
+The impact was focused on the mass compromise of critical authentication data,
+significantly increasing security risks for numerous organizations. The 6
+million records stolen included sensitive credentials such as encrypted
+SSO/LDAP passwords, key files, and authentication tokens. This exposure created
+a high risk of unauthorized account takeover, corporate espionage, and lateral
+movement within affected customers' environments, particularly if the encrypted
+credentials could be cracked. Furthermore, the threat actor sought to monetize
+the breach through extortion, demanding fees from companies to remove their data
+from the leak. The incident led to CISA guidance on credential risk mitigation
+and resulted in class action lawsuits against Oracle for alleged failure to
+implement standard data security practices and timely disclosure.
+
+## Type of Compromise
+
+Even though this was not related to a software package, this is considered to be
+a _Publishing Infrastructure_ type of compromise as it originated from
+vulnerabilities within Oracle’s identity and authentication infrastructure, a
+critical part of its service publishing and access layer.
+
+## References
+
+- [CloudSEK – The Biggest Supply Chain Hack of 2025: 6M Records Exfiltrated from Oracle Cloud](https://www.cloudsek.com/blog/the-biggest-supply-chain-hack-of-2025-6m-records-for-sale-exfiltrated-from-oracle-cloud-affecting-over-140k-tenants)
+- [CVE-2021-35587 – Oracle Access Manager Remote Code Execution Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2021-35587)

community/catalog/compromises/2025/review-dog.md

@@ -0,0 +1,31 @@
+<!-- cSpell:ignore reviewdog -->
+
+# reviewdog/action-setup@v1 GitHub Action Compromise
+
+In March 2025, security researchers discovered that the reviewdog/action-setup@v1
+GitHub Action had been compromised. The attacker altered the v1 tag to point to a
+malicious commit between March 11 and later reverted it to conceal the compromise.
+Encoded payloads were embedded into the install.sh script and any running
+workflows using this Action would execute the malicious code. The code, when
+executed in CI pipelines, could dump workflow environment variables into logs,
+exposing them this way to anyone viewing the CI run.
+
+## Impact
+
+By redirecting the trusted @v1 tag to a malicious commit, the attacker caused
+workflows using this Action to execute injected code that printed environment
+variables and secrets into build logs. This could lead to the unintentional
+disclosure of access tokens, API keys, and credentials, particularly in public
+repositories where logs are accessible, undermining the confidentiality of
+automated build environments.
+
+## Type of Compromise
+
+This is a _Publishing Infrastructure_ type of compromise, as the attacker
+manipulated the Action's distributed version reference (Git tag) rather than its
+codebase or maintainer, abusing weaknesses in how automation components are
+published and trusted within GitHub's workflow ecosystem.
+
+## References
+
+- [New GitHub Action supply chain attack: reviewdog/action-setup](https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup)

community/catalog/compromises/2025/rh-gitlab-instance.md

@@ -0,0 +1,34 @@
+<!-- cSpell:ignore exfiltrated -->
+
+# Red Hat Consulting GitLab Instance Breach
+
+In October 2025, Red Hat confirmed a security breach affecting a self-hosted
+GitLab instance used internally by its Consulting division. The threat actor
+group calling themselves Crimson Collective claimed responsibility, asserting
+they had exfiltrated approximately 570 GB of compressed data from 28,000 private
+repositories, including around 800 Customer Engagement Reports (CERs). These
+CERs often contain sensitive customer architecture diagrams, configuration files,
+authentication tokens, and infrastructure details.
+
+## Impact
+
+Attackers claim to have accessed a significant volume of sensitive consulting
+and customer data.Stolen CERs may reveal network topologies, access credentials,
+and deployment configurations for major enterprise clients. That kind of
+information could be leveraged for secondary intrusions or social engineering.
+While Red Hat has not confirmed any misuse of the stolen data, the incident
+highlights the inherent risk of third-party data exposure within vendor
+ecosystems. Red Hat emphasized that no personal data or software supply chain
+assets have been confirmed compromised at this stage.
+
+## Type of Compromise
+
+This is a _Publishing Infrastructure_ type of compromise as the compromise
+occurred within Red Hat’s internal GitLab environment, which is part of its
+development and collaboration infrastructure.
+
+## References
+
+- [Security update: Incident related to Red Hat Consulting GitLab instance](https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance)
+- [Red Hat confirms security incident after hackers breach GitLab instance](https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance)
+- [Red Hat GitLab Data Breach: The Crimson Collective's Attack](https://blog.gitguardian.com/red-hat-gitlab-breach-the-crimson-collectives-attack/)