BdThemes plugins poisoned through the vendor's banner feed

Git / GitHub CI/CD SaaS Linux distro / packages

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0111 Malicious code contribution to an open-source repository
T0209 Compromise package registry or CDN origin
T0143 External user accounts

supply-chain campaign

T0111 · Resource Development · Malicious code contribution to an open-source repository

Malicious code in distributed plugin/mod packages.

T0209 · Initial Access · Compromise package registry or CDN origin

Distribution origin hosted the trojanized artifact.

T0143 · Initial Access · External user accounts

External GitHub commenter triggered the release workflow — no role check.

Sources

https://www.wordfence.com/blog/2026/08/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response/