The newest Supply Chain Security resources are on the Supply Chain Security page. For a reading order instead of a date order, see the Supply Chain Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-19 2026 | Defending Against npm Supply Chain Attacks — Splunk intermediate 17 min read | Library for detecting and analyzing npm supply chain attacks. It offers tools like `npm-threat-emulation` for safe adversary simulation and `Package-Inferno` for deep package analysis. The library addresses the challenges of understanding npm's attack surface, the detection gap in traditional security tools, and the need for realistic testing against evolving threats, including self-propagating worms and sophisticated phishing campaigns targeting cryptocurrency wallets and CI/CD environments. |
| 2026-04-19 2026 | Multiple Supply Chain Attacks against npm Packages — Red Hat news 2 min read | Analysis of multiple npm supply chain attacks, including "s1ngularity" targeting Nx, a broad "popular packages" campaign hitting developers of frequently downloaded packages like `debug` and `chalk`, and the "shai-hulud" worm and its subsequent waves. These campaigns impacted hundreds of Node.js components, though Red Hat products remained unaffected due to version pinning practices. |
| 2026-04-19 2026 | Shai-Hulud Malware: Second-Wave npm Supply Chain Attack news 4 min read | Analysis of the Shai-Hulud malware campaign details a second wave of supply-chain attacks targeting npm packages, exploiting preinstall scripts like setup_bun.js to exfiltrate developer secrets including GitHub, AWS, GCP, and Azure credentials. This malware self-propagates using stolen npm tokens and can delete home directories if exfiltration fails. Recommendations include reviewing GitHub for malicious repositories, identifying and removing affected npm packages, and rotating compromised secrets such as AWS access keys and GitHub personal access tokens. → arcticwolf.com |
| 2026-04-19 2026 | CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem news 2 min read | Alert regarding a widespread supply chain compromise impacting the npm ecosystem. A self-replicating worm, "Shai-Hulud," has compromised over 500 packages, exfiltrating sensitive credentials like GitHub PATs and API keys for AWS, GCP, and Azure. CISA urges dependency reviews, checking lock files, pinning versions, rotating credentials, mandating MFA, and hardening GitHub security to detect and remediate this threat. |
| 2026-04-18 2026 | Supply Chain Cyber Attacks Surge as EU Breach Exposes Weaknesses news 4 min read | Analysis of a supply chain cyberattack targeting the Trivy security scanner, which led to a significant European Commission cloud breach. Attackers exploited misconfigured GitHub Actions workflows to compromise Trivy, subsequently harvesting data from CI/CD environments and exfiltrating sensitive information after gaining AWS credentials. This incident highlights the widespread impact of compromised dependencies, affecting thousands of repositories and multiple EU entities, and underscores the increasing reliance on and vulnerability of open-source tools within modern software supply chains. |
| 2026-04-18 2026 | Trivy Supply-Chain Attack: Trusted Scanner Compromised Rotate CI/CD Secrets Now news 7 min read | Library for securing CI/CD pipelines against supply-chain attacks, particularly concerning the Trivy scanner compromise (CVE-2026-33634, GHSA-69fq-xp46-6×23). The library details techniques for mitigating risks associated with compromised scanning tools, including mandatory secret rotation, auditing pipeline runs, pinning GitHub Actions tags to immutable SHAs, enforcing least-privilege for runners, and increasing monitoring. It highlights how attackers exploit tag mutability and privileged scanner access to steal credentials and access cloud environments. |
| 2026-04-17 2026 | Q1 2026 Open Source Malware Index: Adaptive Attacks Exploit Trust news 5 min read | Index of Q1 2026 open source malware details 21,764 malicious packages, with npm accounting for 75% and trojans dominating credential theft and host reconnaissance. Defining the quarter was trust abuse, as seen in the SANDWORM_MODE campaign's adaptive behavior, the LiteLLM compromise via trusted tooling, and the axios compromise exploiting transitive dependencies, highlighting attackers' success by hiding behind legitimate workflows and package names. → sonatype.com |
| 2026-04-17 2026 | Critical Supply Chain Attack on EssentialPlugin WordPress Suite Exposes Over 400000 Websites to Malware news 6 min read | Writeup of a critical supply chain attack on the EssentialPlugin WordPress suite, impacting over 400,000 websites. The attack involved a dormant backdoor, introduced after the plugin's acquisition, which activated to enable arbitrary file writes and malware injection. The technique utilized unauthenticated REST API endpoints and PHP object injection to create a backdoor file (wp-comments-posts.php) and modify wp-config.php, leading to spam pages and redirects. Mitigation involves immediate removal of affected plugins and manual inspection for malicious files. → rescana.com |
| 2026-04-17 2026 | Closing the Chain: How to reduce SolarWinds/Log4j/XZ risk (arXiv) intermediate 1 min read | Analysis of SolarWinds, Log4j, and XZ Utils attacks systematically maps attacker techniques to 73 mitigation tasks across 10 software supply chain frameworks. Prioritized mitigation tasks include role-based access control, system monitoring, and boundary protection. The analysis also identified critical missing tasks, such as sustainable open-source software support and environmental scanning tools, highlighting continued vulnerabilities in existing frameworks. → arxiv.org |
| 2026-04-17 2026 | SolarWinds Supply Chain Attack (Fortinet) news | SolarWinds Supply Chain Attack (Fortinet) |
| 2026-04-17 2026 | ossf/malicious-packages: Reports of malicious open source packages news 5 min read | Database of malicious open source packages, consumable via the OSV format, documenting attacks like typosquatting, dependency confusion, and account takeovers. This resource aims to protect the community by providing a comprehensive collection of identified malicious packages from various ecosystems, including npm and PyPI, serving as a data source for improved detection and analysis of emerging open source malware. |
| 2026-04-17 2026 | 5 Examples of Dependency Confusion Attacks (Spectral) intermediate 6 min read | Examples of dependency confusion attacks are detailed, showcasing how attackers exploit trust in public package repositories to inject malicious code into software supply chains. The article illustrates this through scenarios like mimicking internal library names, typosquatting, and exploiting versioning ambiguities, referencing specific instances with npm and PyPI. It highlights the risks, including remote code execution and data theft, and proposes countermeasures such as prioritizing internal repositories, specifying exact versions, and employing monitoring tools to detect suspicious package releases. |
| 2026-04-17 2026 | What Is a Dependency Confusion Attack? (Aqua Security) beginner 7 min read | Library detailing dependency confusion attacks, a software supply chain technique where malicious code replaces legitimate application dependencies. The article explains how attackers exploit dependency configurations by planting malicious versions in repositories, using typosquatting, or even leveraging "hallucinated" dependencies from AI-generated code. It references real-world incidents involving PyTorch, npm, and ethical hacking demonstrations against companies like Apple. |
| 2026-04-17 2026 | Defender's Perspective: Dep Confusion and Typosquatting (SLSA) intermediate 8 min read | Reference on dependency confusion and typosquatting attacks, detailing how these exploit package manager vulnerabilities for arbitrary code execution. It highlights the attacker's methods, including package name reconnaissance and malicious payload injection. The entry also discusses mitigations such as namespacing and pinning, and emphasizes how SLSA build provenance can create secure bindings between package names, versions, source repositories, and build systems to defend against these supply chain risks. |
| 2026-04-17 2026 | SBOMs in 2026: Some Love, Some Hate, Much Ambivalence news | SBOMs in 2026: Some Love, Some Hate, Much Ambivalence → darkreading.com |
| 2026-04-17 2026 | Software Bill of Materials (SBOM) (CISA) beginner 2 min read | Guide from CISA detailing Software Bill of Materials (SBOM) as a critical component for software security and supply chain risk management. It outlines SBOM's role as a nested inventory of software ingredients, discusses advancements since 2018 through multistakeholder efforts, and promotes adoption through community work and operationalization. The guide also touches upon Vulnerability Exploitability eXchange (VEX) documents as attestations for vulnerability impact. |
| 2026-04-17 2026 | About SLSA (spec v1.2) beginner 5 min read | Framework for Supply-chain Levels for Software Artifacts (SLSA) v1.2 offers incrementally adoptable guidelines for supply chain security, aiding both software producers and consumers. It establishes a common vocabulary, provides methods to secure incoming supply chains by evaluating artifact trustworthiness, and includes checklists for improving software security, aligning with the Secure Software Development Framework (SSDF). SLSA addresses risks exposed by attacks like SolarWinds and Codecov, protecting against code modification and ensuring artifacts originate from expected build platforms, thereby increasing confidence in the integrity of software from source to binary. |
| 2026-04-17 2026 | What is a Software Bill of Materials (SBOM)? (Snyk) beginner 6 min read | Library for generating and managing Software Bills of Materials (SBOMs), providing formal records of software components and their supply chain relationships. SBOMs enhance transparency, aid in vulnerability management, and support regulatory compliance, especially for software sold to the federal government as mandated by Executive Order 14028. Standards like SPDX, SWID, and OWASP CycloneDX are supported, enabling detailed analysis of dependencies, licenses, and potential exploits, complementing efforts like SLSA for supply chain integrity. → snyk.io |
| 2026-04-17 2026 | SBOM Literature Review (arXiv) news 51 min read | Survey of Software Bill of Materials (SBOM) literature systematically reviews 40 studies on SBOMs for software supply chain security, identifying five key application areas: vulnerability management, transparency, component assessment, risk assessment, and integrity. Adoption barriers include generation tooling, data privacy, standardization issues with formats like SPDX and CycloneDX, and challenges with analysis and maintenance. The review maps these barriers to the ISO/IEC 25019:2023 Quality-in-Use model, highlighting deficiencies in trustworthiness and usability, and notes gaps in machine learning and software quality assurance applications. → arxiv.org |
| 2026-04-17 2026 | SBOM + SLSA: Accelerating SBOM success with SLSA intermediate 6 min read | Library that uses Supply-chain Levels for Software Artifacts (SLSA) principles to enhance Software Bill of Materials (SBOM) accuracy and trustworthiness. By integrating SLSA's tamper-evident provenance data, generated during the build process, with SBOMs, this approach addresses limitations in traditional SBOM generation. This results in more complete and verifiable SBOMs, helping users identify affected components, trust the software's origin, and respond effectively to supply chain attacks, drawing parallels with food safety standards and leveraging tools like Sigstore and in-toto. |
| 2026-04-17 2026 | SLSA - Comprehensive Approach to Supply Chain Security (SBOM Observer) beginner 2 min read | Framework SLSA offers a structured hierarchy of security practices for software supply chain fortification, building from fundamental component identification to hermetic sealing against tampering. When integrated with Software Bills of Materials (SBOMs), SLSA elevates transparency and mitigates risks by ensuring components are sourced, developed, and deployed securely, utilizing cryptographic signatures and trusted build environments like CI/CD. This comprehensive approach empowers organizations to dramatically reduce susceptibilities to cyberattacks and threats. |
| 2026-04-17 2026 | Understanding SBOM: Transparency & Security in Supply Chains (Cycode) beginner 28 min read | Library for generating and managing Software Bills of Materials (SBOMs), serving as a detailed inventory of all software components, libraries, and dependencies. This resource aids in enhancing application security, mitigating supply chain risks, ensuring license compliance, and meeting regulatory mandates like Executive Order 14028. It supports automation for DevSecOps pipelines and facilitates faster incident response by providing transparency into software composition. |
| 2026-04-17 2026 | What We Know About the NPM Supply Chain Attack (Trend Micro) news 9 min read | Library detailing the Shai-hulud worm's attack chain, which exploits compromised NPM maintainer accounts to inject malicious code into popular JavaScript packages. This worm self-propagates by hijacking web APIs, diverting cryptocurrency, stealing cloud service tokens, and deploying secret-scanning tools, impacting organizations across North America and Europe. → trendmicro.com |
| 2026-04-17 2026 | New Supply Chain Malware Operation Hits npm and PyPI news 6 min read | Library of malware operations targeting npm and PyPI packages, including GlueStack for remote command execution and screenshotting, express-api-sync and system-health-sync-api for file deletion, and imad213 on PyPI for harvesting Instagram credentials. These attacks leverage compromised accounts and malicious code injection to steal information, sabotage systems, and exfiltrate data via covert channels like SMTP. → thehackernews.com |
| 2026-04-17 2026 | npm Supply Chain Attack: Debug, Chalk + 16 Packages Compromise (Upwind) news 3 min read | Library compromised in an npm supply chain attack involving malicious versions of `debug`, `chalk`, and 16 other packages. The attacker used a phishing campaign, obtaining account credentials and a TOTP code via a fake 2FA reset email from `npmjs.help`. The malware, a browser-only script, targeted cryptocurrency wallets by intercepting `window.ethereum` calls and manipulating network responses using a Levenshtein algorithm, affecting Ethereum, Bitcoin, Litecoin, Tron, BCH, and Solana. |
| 2026-04-17 2026 | Malicious PyPI, npm, Ruby Packages Exposed (The Hacker News) news 5 min read | Library updates on npm, PyPI, and Ruby pose significant supply chain risks, with malicious packages identified for draining cryptocurrency, erasing codebases, and exfiltrating Telegram API tokens. These threats include typosquatting attacks like "xlsx-to-json-lh" on npm and impersonating "colorama" on PyPI, alongside novel techniques such as "monkey patching" Solana key generation and injecting infostealers into PyTorch models. Vendors like Checkmarx, ReversingLabs, Safety, and Socket reported these findings, highlighting the exploitation of geopolitical events and the growing threat of AI-themed package abuse. → thehackernews.com |
| 2026-04-17 2026 | A Closer Look at Software Supply Chain Attacks 2025 (Xygeni) beginner 6 min read | Tool for detecting software supply chain attacks; Xygeni's Malware Early Warning (MEW) identified malicious PyPI package `graphalgo` and npm package `express-cookie-parser`, both employing typosquatting, obfuscation via ZLib compression and Base64 encoding, a shared seed file URL, dynamic C2 resolution with a DGA, and persistence through startup scripts in Chrome user data directories. |
| 2026-04-17 2026 | The PyPI Supply Chain Attacks of 2025: What Python Engineers Should Learn beginner Python | The PyPI Supply Chain Attacks of 2025: What Python Engineers Should Learn |
| 2026-04-17 2026 | Cyber threats for PV: What are supply chain attacks and how do they work beginner 4 min read | Analysis of supply chain attacks targeting PV systems, which exploit trusted third-party vendors and components like inverter firmware and monitoring software. These attacks introduce malicious code through compromised updates or hardware, enabling unauthorized access, data exfiltration, and system manipulation. Defense strategies include strict vendor risk management, code signing, network segmentation, continuous monitoring, and asset management to mitigate the risks of compromised components and their widespread impact. |
| 2026-04-17 2026 | Securing software supply chain without slowing development beginner 4 min read | Library for securing software supply chains, focusing on automation, visibility, and policy enforcement. It addresses risks from third-party code and open-source libraries, citing examples like the SolarWinds and British Airways attacks. Best practices include end-to-end dependency insight, custom policy definition, automated updates, continuous monitoring, and developer education. The library aims to enable secure innovation without slowing development, aligning with mandates like the EU's Digital Operational Resilience Act. |
| 2026-04-17 2026 | Securing the Software Supply Chain: How SentinelOne's AI EDR Autonomously Blocked the CPU-Z Watering Hole Cyber Attack beginner 7 min read | Library detailing SentinelOne's AI EDR autonomous blocking of the CPU-Z watering hole attack. The attack involved trojanized download infrastructure and a reflective payload, CRYPTBASE.dll, employing XXTEA encryption and DEFLATE decompression, with STX RAT as the final payload delivering hidden VNC, credential theft, and a reverse proxy. The entry highlights behavioral detection's efficacy against supply chain compromises, anomalous API resolution, reflective code loading, suspicious memory allocation, process injection patterns, and heuristic shellcode signatures, noting attacker reuse of C2 infrastructure and STX RAT YARA rules from a previous FileZilla campaign. → sentinelone.com |
| 2026-04-17 2026 | Your Supply Chain Breach Is Someone Else's Payday news 6 min read | Analysis of the TeamPCP supply chain attack reveals how a single stolen credential can lead to cascading compromises across multiple software ecosystems. The group injected credential-harvesting malware into LiteLLM and poisoned Checkmarx GitHub Actions, demonstrating how identity is the primary attack surface. This breach highlights risks beyond ransomware, including payroll redirection, freight rerouting, and extortion, underscoring the need for continuous, AI-augmented integrity verification and third-party due diligence. |
| 2026-04-16 2026 | Learnings from Recent npm Supply Chain Compromises - Datadog intermediate 7 min read | Analysis of recent npm supply chain compromises, including the s1ngularity, Qix, and Shai-Hulud attacks, highlights critical vulnerabilities. Attackers exploited GitHub Actions pull_request_target triggers, phishing campaigns mimicking npm 2FA resets, and unrotated credentials to inject malicious code, steal secrets, and hijack cryptocurrency transactions. Specific malware like telemetry.js and crypto-stealing scripts were deployed across hundreds of compromised npm packages. The analysis emphasizes the need for hardened CI/CD workflows, immediate credential rotation, MFA, and fine-grained access tokens to mitigate these widespread risks. → securitylabs.datadoghq.com |
| 2026-04-16 2026 | Inside the Axios Supply Chain Compromise - Elastic Security Labs intermediate 7 min read | Analysis of the Axios supply chain compromise details how a maintainer account compromise led to malicious versions of the popular Axios npm package (versions 1.14.1 and 0.30.4) being published. These versions delivered cross-platform Remote Access Trojans (RATs) for macOS, Windows, and Linux via a backdoor in the `plain-crypto-js` dependency's `postinstall` hook. The RATs shared an identical C2 protocol, command set, and beacon cadence, employing an anachronistic IE8 user-agent for network communication. The dropper also performed anti-forensic cleanup by deleting itself and swapping its `package.json`. |
| 2026-04-16 2026 | Lockfile Poisoning: Introducing Malware in Supply Chain - SafeDep intermediate 3 min read | Tool for detecting Lockfile Poisoning attacks targeting the npm ecosystem. This technique exploits the cognitive load of reviewing auto-generated `package-lock.json` files to introduce malware by tampering with artifact URLs or adding malicious entries. The `vet` tool verifies package source URLs against trusted registries and checks for inconsistencies to prevent such supply chain compromises. |
| 2026-04-16 2026 | Shai-Hulud 2.0: Most Aggressive NPM Supply Chain Attack of 2025 - Check Point news 3 min read | Writeup of Shai-Hulud 2.0, an aggressive npm supply chain attack targeting developers. The campaign, active in November 2025, compromised hundreds of npm packages and thousands of GitHub repositories, exfiltrating multi-cloud and developer credentials like GitHub access tokens, AWS, GCP, and Azure credentials. Attackers utilized npm's preinstall lifecycle script and the Bun runtime for evasion, exfiltrating data to GitHub repositories. The attack demonstrated a significant escalation from dependency compromise to multi-cloud access and CI/CD infiltration. |
| 2026-04-16 2026 | Supply Chain Security: Sigstore and Cosign - GitGuardian beginner 9 min read | Library for signing and verifying container images using Sigstore's Cosign. This resource details Sigstore, a suite of tools designed to secure software supply chains by ensuring software integrity. It focuses on Cosign, a tool for signing artifacts within OCI registries, utilizing features like hardware and KMS signing, and integration with Kubernetes Secrets. The library allows users to generate key pairs, sign images by digest, and verify signatures against a provided public key, addressing the challenges of managing and integrating cryptographic signing into CI/CD workflows. → blog.gitguardian.com |
| 2026-04-16 2026 | GuardDog: CLI Tool to Identify Malicious PyPI and npm Packages beginner 4 min read | Tool for identifying malicious PyPI and npm packages, Go modules, RubyGems, GitHub actions, and VSCode extensions. GuardDog leverages Semgrep rules and metadata heuristics to scan package source code and metadata. It supports scanning local or remote packages and custom rule creation using Semgrep or Yara formats. Integration with GitHub Actions is facilitated through SARIF output for code scanning. |
| 2026-04-16 2026 | tj-actions Supply Chain Attack (CVE-2025-30066) - Sysdig news 3 min read | Writeup detailing the tj-actions/changed-files supply chain attack (CVE-2025-30066), where a malicious Node.js function was injected to steal GitHub Runner credentials via memory scanning and exfiltration. The writeup covers the attack mechanics, affected repositories, and detection strategies using Falco rules and Sysdig Secure runtime monitoring, emphasizing the need to rotate secrets in affected public and private repositories. |
| 2026-04-16 2026 | tj-actions/changed-files Compromised - Semgrep news 4 min read | Semgrep rule for detecting compromised GitHub Actions, specifically targeting `tj-actions/changed-files` and `reviewdog/action-setup@v1`. This action, `tj-actions/changed-files`, was previously compromised and may have leaked secrets. The rule helps identify usages of these actions within CI pipelines, enabling prompt remediation and security audits. Users can run this rule locally or within the Semgrep AppSec Platform in blocking mode to prevent further compromise. |
| 2026-04-16 2026 | Most Notable Supply Chain Attacks of 2025 - Kaspersky news 10 min read | Survey of notable supply chain attacks in 2025, detailing incidents including a RAT in DogWifTools, the US$1.5 billion Bybit heist via Safe{Wallet}, a GitHub Actions compromise targeting Coinbase, backdoors in 21 Magento extensions, ransomware distributed through an MSP exploiting SimpleHelp, injected malicious code in Gluestack npm packages, phishing attacks on npm package maintainers, and the s1ngularity attack on the Nx build system. → kaspersky.com |
| 2026-04-16 2026 | GitHub Actions Supply Chain Attacks: tj-actions and reviewdog - Hunters news 5 min read | Analysis of CVE-2025-30066 and CVE-2025-30154 details a CI/CD supply-chain attack targeting GitHub Actions, specifically impacting tj-actions/changed-files and reviewdog/action-setup. Threat actors injected malicious code to exfiltrate secrets by logging them, leveraging unauthorized modifications to repository tags to redirect users to compromised commits. This attack, potentially originating against Coinbase, evolved into a broader campaign, highlighting risks in CI/CD security and necessitating actions like ceasing usage of affected actions and rotating secrets. |
| 2026-04-16 2026 | Supply Chain Cyber Attacks Surge as EU Breach Exposes Weaknesses news 4 min read | Analysis of supply chain cyber attacks highlights increasing threats via compromised open-source tools like Trivy. Attacks leverage misconfigured GitHub Actions and exploit trust in legitimate update channels to infiltrate cloud systems, harvest credentials, and exfiltrate data. The European Commission breach, affecting multiple EU websites and Union entities, exemplifies how vulnerabilities in components like Trivy can cascade, impacting tens of thousands of repositories and exposing sensitive customer information. |
| 2026-04-16 2026 | Axios Supply Chain Attack Hits OpenAI: Users Urged to Update macOS Certificates news | Axios Supply Chain Attack Hits OpenAI: Users Urged to Update macOS Certificates https://ift.tt/3IP51Bc |
| 2026-04-16 2026 | Defending Supply Chains Software Pipelines Against Nation-State Compromise intermediate | Defending Supply Chains, Software Pipelines Against Nation-State Compromise https://ift.tt/erOhXZ7 |
| 2026-04-16 2026 | Supply chain dependencies: Have you checked your blind spot? beginner 9 min read | Survey of supply chain cyber risks, highlighting blind spots such as indirect vendor vulnerabilities, compromised software components, and reliance on single vendors. The analysis cites incidents like the 2023 3CX compromise, the 2024 CDK and Change Healthcare ransomware attacks, the 2025 Jaguar Land Rover ransomware attack, and the July 2024 faulty CrowdStrike update to illustrate how disruptions can cascade, impacting businesses, economies, and national security. |
| 2026-04-16 2026 | Why Software Supply Chain Security Requires a New Playbook beginner 4 min read | Library providing techniques for securing software supply chains, addressing risks from malicious dependencies like typosquatting packages, compromised trusted components, and insecure CI/CD pipelines. It advocates for an integrity-driven development approach, shifting from reactive defense to proactive prevention by controlling entry into development environments, verifying code integrity, minimizing access, and real-time monitoring, effectively treating software delivery as a security process. → sonatype.com |
| 2026-04-15 2026 | Supply-chain attacks against open source projects could have incredible impact beginner 3 min read | Analysis of supply-chain attacks targeting open-source security scanners like Trivy, LiteLLM, and Telnyx, where attackers inject credential-stealing malware through GitHub Actions and container images. This compromises development pipelines, impacting thousands of organizations and potentially millions of users. Recommended mitigation includes waiting a week before adopting new open-source packages and implementing review processes to scan for backdoors. |
| 2026-04-15 2026 | The Future Of GitHub Actions Security And What You Can Do Right Now intermediate 7 min read | Library for securing GitHub Actions, focusing on proactive measures and current realities. It addresses GitHub's evolving roadmap toward deterministic workflow dependencies, centralized execution policy, and tighter secret scoping. The library helps organizations manage the immediate risks of scattered secrets and compromised automation layers, providing visibility, detection, and remediation for existing environments before platform-level controls are fully implemented. → blog.gitguardian.com |
| 2026-04-15 2026 | OpenAI Rotates macOS Certificates After Axios Supply Chain Attack news 2 min read | Analysis of OpenAI's response to a supply chain attack targeting the Axios npm package, attributed to a North Korea-linked actor. This incident led to OpenAI rotating its macOS code signing certificates to mitigate risks after a GitHub Actions workflow was compromised. Users of ChatGPT Desktop, Codex, and Atlas applications must update by May 8, 2026, as older versions will cease functioning due to certificate revocation. The attack highlights the vulnerability of dependency management, specifically referencing misconfigurations in pinning package versions. |