Supply Chain learning path

Orientation and first principles — what the bug class is and how it behaves.

1. LiteLLM AI Supply Chain Attack Explained
   21 min readsocradar.io2026
   Analysis of the LiteLLM supply chain attack reveals that 95% of exposed organizations were affected before the malicious PyPI packages (v1.82.7 and v1.82.8) were live for 40 minutes on March 24, 2026. This attack, part of the wider TeamPCP campaign (CVE-2026-33634), leveraged a compromised Trivy scanner to inject credential-stealing code. The payload executed at Python startup via a `.pth` file, harvesting cloud, SSH, Kubernetes, database, and AI provider keys (e.g., OPENAI_API_KEY). Exposure extended beyond AI tools to frameworks like DSPy, MLflow, CrewAI, and others, impacting over 2,500 companies.
2. Creating SBOMs with the Snyk CLI
   6 min readsnyk.io2026
   Library for generating Software Bills of Materials (SBOMs) using the Snyk CLI. It supports various programming languages and package managers, creating SBOMs in CycloneDX, XML, or SPDX formats. The Snyk CLI can also scan existing SBOM files for known vulnerabilities and integrates with tools like Bomber for analysis. Automating SBOM generation within CI/CD pipelines is crucial for security, compliance, and transparency.
3. [tl;dr sec] #327 - Finding Zero-days with Any Model, Practical Package Security, Measuring the AI Offense-Defense Gap
   15 min readtldrsec.com2026
   Library for finding vulnerabilities in codebases, deepsec employs AI coding agents like Claude Opus 4.7 and GPT-5.5, running on user infrastructure. It conducts regex sweeps, traces data flows, and assesses severity with a refusal-detection classifier, reducing false positives through a revalidation step and offering plugin system for tuning and parallel execution.
4. Practical Package Security: The Unofficial Guide
   6 min readwiz.io2026
   Guide on practical package security, this resource addresses risks in third-party package consumption. It details mitigations like minimizing dependencies, adopting cooldown periods for updates, utilizing lockfiles and hashes, employing wrapper tools, and restricting install-time execution. Organizational controls include protecting execution environments with remote developer environments and zero trust production, and controlling installations via registry pull-through proxies or curated registries. Examples like TeamPCP / Trivy-action and Axios supply chain compromises highlight the urgency of these practices.
5. Well-architected best practices for software supply chain security
   11 min readaws.amazon.com2026
   Reference for software supply chain security best practices, aligned with the AWS Well-Architected Framework. This document details techniques to mitigate risks from compromised maintainer accounts and malicious package downloads, referencing incidents like Shai-Hulud and the exploitation of npm packages. Key recommendations include using temporary credentials, enforcing least privilege access, implementing multi-factor authentication, and utilizing artifact signing with services like AWS Signer to create defense-in-depth strategies.

Real testing methodology, tooling, and writeups that show the work.

1. Inside the Axios Supply Chain Compromise - Elastic Security Labs
   7 min readelastic.co2026
   Analysis of the Axios supply chain compromise details how a maintainer account compromise led to malicious versions of the popular Axios npm package (versions 1.14.1 and 0.30.4) being published. These versions delivered cross-platform Remote Access Trojans (RATs) for macOS, Windows, and Linux via a backdoor in the `plain-crypto-js` dependency's `postinstall` hook. The RATs shared an identical C2 protocol, command set, and beacon cadence, employing an anachronistic IE8 user-agent for network communication. The dropper also performed anti-forensic cleanup by deleting itself and swapping its `package.json`.
2. Disrupting supply chain attacks on NPM and GitHub Actions
   7 min readgithub.blog2026
   Library of hardening features for npm and GitHub Actions that disrupt common supply chain attack techniques. Implemented measures include preventive account protection for high-impact npm accounts, safer default pull_request_target behavior for GitHub Actions checkout, controls for workflow triggers, read-only Actions cache for untrusted triggers, and integration with CircleCI for trusted publishing. Additional disruptions involve staged publishing for npm, disabling install scripts by default in npm v12, and a default package cooldown for Dependabot version updates. Features also aid in identifying and responding to attacks, such as self-service credential revocation.
3. Disrupting supply chain attacks on npm and GitHub Actions
   7 min readgithub.blog2026
   Library for hardening npm and GitHub Actions against supply chain attacks, implementing measures such as account protection for high-impact npm accounts, safer pull_request_target defaults for GitHub Actions checkout, workflow execution policies, read-only Actions cache for untrusted triggers, trusted publishing support for CircleCI, Actions network firewall preview, staged publishing for npm, disabling npm install scripts by default, Dependabot package cooldown, and self-service credential revocation for incident response.
4. Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
   11 min readmicrosoft.com2026
   Analysis of the @asyncapi npm supply chain compromise details a multi-stage attack exploiting a vulnerable GitHub Actions workflow to inject malicious loaders into five package versions. This campaign bypassed traditional `npm install --ignore-scripts` mitigations by executing its payload at module import time, leading to the download and execution of a Miasma modular runtime with C2, persistence, and fallback channels. Microsoft Defender Antivirus detects related artifacts as Trojan:JS/MiasmStealer.SC and Trojan:Script/Supychain.A.
5. Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories
   11 min readstepsecurity.io2026
   Library for detecting and blocking coordinated AsyncAPI supply chain attacks. This resource details the Miasma RAT delivery via compromised CI/CD pipelines in two AsyncAPI repositories, impacting packages like `@asyncapi/generator` and `@asyncapi/specs`. It highlights how attackers exploited legitimate GitHub Actions release workflows and OIDC provenance to publish malicious npm packages, and how Harden-Runner blocked exfiltration by identifying C2 endpoints through network telemetry.

Novel research, edge cases, and the techniques that push the class forward.

1. Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System
   15 min readaikido.dev2026
   Library for analyzing `binding.gyp` files, highlighting how this npm build system, invoked by `node-gyp`, can be abused to execute arbitrary code during package installation. It details the `<!(...)` command expansion syntax used in `binding.gyp` for executing shell commands and the subsequent sandbox escape vulnerability allowing arbitrary Python code execution via `eval()`, as demonstrated by the Miasma attack which targeted numerous npm packages.
2. How “Clinejection” Turned an AI Bot into a Supply Chain Attack
   9 min readsnyk.io2026
   Analysis of the "Clinejection" vulnerability chain details how an AI bot in the Cline repository was exploited via indirect prompt injection and GitHub Actions cache poisoning to facilitate a supply chain attack. This attack, discovered by Adnan Khan and later exploited by an unknown actor, leveraged a GitHub issue to trick the AI triage bot into executing malicious code from a compromised commit. The attacker then used cache poisoning with the Cacheract tool to gain access to production credentials, ultimately publishing a malicious version of the Cline CLI to npm, which installed the OpenClaw AI agent.
3. Ghostcommit: Multimodal Prompt Injection Attack Exposes AI Code Review Tools to Supply Chain Risks
   5 min readrescana.com2026
   Library detailing Ghostcommit, a multimodal prompt injection attack that embeds malicious instructions within image files to bypass AI code review tools like CodeRabbit and Bugbot, enabling secret exfiltration and repository manipulation by exploiting blind spots in current AI agent workflows and supply chain dependencies.
4. Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
   22 min readunit42.paloaltonetworks.com2026
   Library of resources detailing "phantom squatting," a software supply chain vulnerability where adversaries register AI-hallucinated domains to intercept traffic from LLMs used in development. The research highlights how tools like the Montana Empire phishing kit leverage this vector, bypassing traditional security measures by exploiting the zero-reputation nature of newly registered, AI-generated domains.
5. Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
   22 min readunit42.paloaltonetworks.com2026
   Analysis of "Phantom Squatting" details how large language models hallucinate web domains, which adversaries then register to intercept traffic from AI systems, posing a significant software supply chain risk. Researchers identified over 13,000 confirmed malicious URLs and approximately 250,000 unregistered hallucinated domains. One real-world case involved an attacker using an AI coding assistant to build a phishing kit targeting a domain predicted to be a high-risk hallucination target. This technique bypasses traditional defenses by leveraging zero-reputation domains generated by trusted AI outputs.
6. OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat
   10 min readunit42.paloaltonetworks.com2026
   Analysis of malicious skills on OpenClaw's ClawHub marketplace, including infostealers like cluw and AMOS, evasion techniques like inflated file sizes, and novel agentic threats such as runtime affiliate injection and front-running. These threats exploit the AI supply chain, leveraging semantic instruction hijacking to bypass technical constraints and gain unauthorized access to agent credentials and authenticated sessions. Early campaigns featured Base64-encoded droppers, paste-site redirects, and persistence via auto-updaters, while later analysis revealed continued use of established delivery templates with fresh infrastructure.
7. The Scanner Was the Weapon: 36 Months of Precision Supply Chain Attacks Against DevSecOps Infrastructure
   16 min readcloudsek.com2026
   Library detailing 36 months of precision supply chain attacks, highlighting compromises of DevSecOps tools like vulnerability scanners and CI/CD pipelines. It examines the XZ Utils backdoor (CVE-2024-3094), the reviewdog GitHub Actions compromise (CVE-2025-30066 / CVE-2025-30154), and the multi-stage infostealer targeting Aqua Security's Trivy. The analysis reveals attacker sophistication in targeting trusted software, leveraging build-time injection and automated trust exploitation.
8. 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
   4 min readthehackernews.com2026
   Library of trojanized npm packages found delivering the AI-powered RedC2 4.0 Linux backdoor. Packages like `streak-metrics-math` and `kit-map-vim` contain functional code alongside the RedShell Linux beacon. RedC2 4.0, advertised as evasion-focused, offers surveillance, credential theft, and advanced post-exploitation via natural language commands through its Red Agent LLM component.