Delivering Malware Through Abandoned Amazon S3 Buckets

Researchers discovered and registered roughly 150 abandoned Amazon S3 buckets that had been used to host software libraries and update artifacts; after registration the buckets received about 8 million requests over two months, illustrating a high-risk supply-chain vulnerability where attackers could swap in malicious code to be pulled into builds and updates while victims lose the ability to patch or identify affected installations.