Supply‑chain Malware Targets Iran

A self‑propagating worm was distributed via a compromised open‑source security scanner (Trivy) and included a payload that selectively wipes machines configured for Iran. The attack combines supply‑chain poisoning, automated worming, and geofencing to weaponize widely trusted developer tooling without direct access to targeted networks. — This raises urgent questions about code‑signing, maintainer account security, vendor responsibility, and whether nation‑targeted destructive payloads delivered through open‑source ecosystems should be treated as acts of cyber‑war.