The newest Supply Chain Security resources are on the Supply Chain Security page. For a reading order instead of a date order, see the Supply Chain Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-06-18 2026 | Developer Machines And Supply Chain Security Risk beginner | This article discusses the significant supply chain security risks posed by compromised developer machines. It highlights how attackers can target these machines to inject malicious code into software projects, leading to widespread vulnerabilities and breaches. The content emphasizes the importance of securing developer environments, including endpoints, code repositories, and build pipelines, as a critical defense against such attacks. The goal is to prevent compromised development tools from becoming entry points for attackers into the software supply chain. → darkreading.com |
| 2026-06-18 2026 | easy-day-js Supply Chain Attack Hits Mastra AI in npm news 3 min read | Writeup of the `easy-day-js` npm supply chain attack, which impacted the `@mastra` organization by hijacking an account to replace the legitimate `dayjs` dependency with a malicious version. This typesquatting attack leveraged a `postinstall` script to download and execute a multi-stage dropper, featuring disabled TLS verification, hardcoded C2 servers, and self-deleting stages. The attack affected 141 packages, leading to account takeover and the distribution of a crypto-stealer, highlighting npm's ongoing vulnerability to dependency hijacking despite upcoming deprecation of install scripts. → ox.security |
| 2026-06-17 2026 | The Overlooked Attack Surface: Securing Code Repositories, Pipelines, and Developer Infrastructure beginner 6 min read | Library for securing developer infrastructure, extending Application Security Posture Management (ASPM) to code repositories, CI/CD pipelines, and artifact registries. It continuously assesses configurations, maps identities, and detects threats across the software supply chain, citing examples like the Ultralytics PyPI attack and Kong's DockerHub compromise. The library integrates with cloud security posture management and detection and response principles, mapping controls to frameworks like CIS Benchmarks and OWASP TOP10 CI/CD Security Risks for proactive risk management. → wiz.io |
| 2026-06-17 2026 | GitHub Action tj-actions/changed-files supply chain attack: everything you need to know news 6 min read Secrets | Library detailing CVE-2025-30066, a supply chain attack on the tj-actions/changed-files GitHub Action. This attack injected malicious code, causing affected public repositories to leak secrets within workflow logs. The compromise, also potentially linked to reviewdog/action-setup, involved a compromised GitHub Personal Access Token (PAT). Mitigation steps include rotating leaked secrets like AWS keys and GitHub PATs, removing references to the affected action, and pinning future actions to specific commit hashes. → wiz.io |
| 2026-06-17 2026 | New GitHub Action supply chain attack: reviewdog/action-setup news 6 min read Secrets | Library detailing a GitHub Action supply chain attack targeting reviewdog/action-setup@v1. This vulnerability, likely a precursor to the tj-actions/changed-files compromise, involved malicious code injected into CI workflows to dump secrets from CI runner memory. Affected repositories, particularly public ones, risked leaking secrets via workflow logs, necessitating immediate rotation of any exposed credentials. Mitigation involves identifying affected workflows, checking for the malicious payload, and removing references to the compromised action. → wiz.io |
| 2026-06-17 2026 | Vulnerabilities in NodeJS C/C++ add-on extensions intermediate 6 min read | Library for analyzing C/C++ vulnerabilities in NodeJS npm packages, focusing on Buffer Overflow, Denial of Service (process crash, unchecked types), and Memory Leakages. It models sources, sinks, and sanitizers using Snyk Code to identify vulnerable patterns within Node-API and Napi interfaces, providing remediation examples for maintainers. → snyk.io |
| 2026-06-17 2026 | Proactive AppSec continuous vulnerability management for developers and security teams beginner 8 min read | Library for continuous vulnerability management that integrates Snyk DeepCode AI into IDEs like VS Code and IntelliJ IDEA. It proactively identifies security issues in open-source components, AI-generated code (e.g., from GitHub Copilot), and containerized applications, offering real-time feedback and mitigations for vulnerabilities like XSS and SQL injection, thereby enhancing application security throughout the development lifecycle. → snyk.io |
| 2026-06-17 2026 | Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE advanced 12 min read AI RCE | Library detailing a vulnerability in the Google Cloud Vertex AI SDK for Python (versions 1.139.0 and 1.140.0) that allows attackers to hijack model uploads. The flaw, termed "Pickle in the Middle," exploits predictable default bucket names and missing ownership checks. Attackers can perform bucket squatting, upload malicious models containing a pickle deserialization payload, and achieve remote code execution within a victim's Vertex AI serving infrastructure. → unit42.paloaltonetworks.com |
| 2026-06-16 2026 | Atomic Arch Supply Chain Attack Hits 1500 AUR Packages news 2 min read | Writeup detailing the Atomic Arch supply chain attack targeting Arch Linux's User Repository (AUR), which compromised over 1,500 packages by modifying build scripts (PKGBUILDs) to execute malicious NPM and Bun-based installations. The attack leveraged abandoned packages, introduced rootkit-like malware for credential harvesting and exfiltration, and utilized eBPF for persistence, making detection and cleanup difficult. → securityweek.com |
| 2026-06-16 2026 | Introducing WizOS: Securing Wiz from the ground up with hardened, near-zero-CVE container base images. intermediate 4 min read | Library for hardened, near-zero-CVE container base images, WizOS, offers a secure foundation for cloud-native applications. It transitions from Alpine's musl to glibc, supports a wider range of applications, and builds every component from source with signing and provenance. WizOS provides a reproducible build pipeline, reducing critical and high CVEs to near zero, thus minimizing build pipeline interruptions and allowing developers to focus on application logic. It's designed as a drop-in replacement for Alpine-based images and is currently available in private preview for Wiz customers. → wiz.io |
| 2026-06-16 2026 | The mysterious supply chain concern of string-width-cjs npm package intermediate 6 min read | Analysis of npm package aliasing and its supply chain risks, triggered by an `string-width-cjs` update in `cliui`. The article details how package aliasing can be abused, referencing a 2021 Snyk disclosure. It highlights the discovery of suspicious, seemingly empty npm packages (`string-width-cjs`, `strip-ansi-cjs`, `wrap-ansi-cjs`) published by an anonymous user, potentially for dependency confusion or typosquatting. The analysis further examines how these packages are pulled into other projects, like `react-native-multiply` and `clazz-transformer`, suggesting a campaign to mine Tea tokens. → snyk.io |
| 2026-06-16 2026 | Ensuring comprehensive security testing in DevOps pipelines beginner 6 min read | Library for integrating comprehensive security testing into DevOps pipelines. It details strategies for assessing application risk profiles and implementing various testing types, including SAST (Snyk Code), SCA (Snyk Open Source), container security (Snyk Container), IaC security (Snyk IaC), DAST, RASP, and API testing. The library emphasizes shifting security left and ensuring coverage across the entire software development lifecycle, from development to production, with recommendations for effective alert notification frameworks. → snyk.io |
| 2026-06-16 2026 | Lottie Player npm package compromised for crypto wallet theft news 3 min read | Writeup detailing the compromise of the `@lottiefiles/lottie-player` npm package, which injected malicious code into versions 2.0.5 through 2.0.7, enabling cryptocurrency wallet theft. The incident highlights supply chain risks, particularly when using CDNs without pinned dependency versions, and details how tools like Snyk can identify vulnerable installations of this and similar packages. → snyk.io |
| 2026-06-15 2026 | GitHub to Update npm to Thwart Software Supply Chain Attacks news 2 min read | Library update npm v12 shifts from implicit trust to explicit opt-in to prevent software supply chain attacks. It will block install scripts, Git dependencies, and remote URLs by default. While praised for structural defenses against threats like Miasma, experts caution about potential developer friction and attackers pivoting to private repositories like Artifactory and Nexus. Developers can prepare by upgrading to npm 11.16.0+ or using `npm approve-scripts` to audit dependencies and build allowlists. → infosecurity-magazine.com |
| 2026-06-15 2026 | Why Runtime Scanning Is Too Late for Your CI/CD Supply Chain Security intermediate 12 min read | Library for securing CI/CD supply chains, emphasizing proactive governance at the point of ingestion over reactive runtime scanning. It highlights the insufficiency of detection-only security postures, citing the xz Utils backdoor as an example, and addresses the significant resource drain and financial costs associated with late-stage detection. The library's approach counters modern attacks like obfuscated payloads and typosquatting by implementing checks before dependencies enter the development lifecycle, preventing compromises before they impact build environments. → thehackernews.com |
| 2026-06-15 2026 | DevOps Tools Targeted for Cryptojacking news 10 min read | Library for detecting and defending against cryptojacking campaigns, specifically targeting DevOps tools like HashiCorp Nomad, Consul, Docker API, and Gitea. This campaign, designated JINX-0132, exploits known misconfigurations and vulnerabilities, including an unpatched RCE in Gitea (CVE-2020-14144) and default Nomad job queueing behavior, to deploy the XMRig miner. Attackers leverage publicly available resources like GitHub repositories for payloads and avoid traditional IOCs, complicating detection. → wiz.io |
| 2026-06-15 2026 | TraderTraitor: Deep Dive advanced 10 min read | Analysis of TraderTraitor details a North Korean threat cluster, linked to Lazarus Group and APT38, that targets cryptocurrency exchanges, DeFi platforms, and crypto startups. The group employs social engineering via phishing emails and trojanized applications, as well as sophisticated supply chain compromises involving malicious npm packages and the JumpCloud incident. TraderTraitor's objective is primarily financial gain through cryptocurrency theft, with notable operations including the DMM Bitcoin exchange heist and the ByBit hack. → wiz.io |
| 2026-06-15 2026 | Ultralytics AI Pwn Request Supply Chain Attack news 6 min read AI RCE | Analysis of the Ultralytics supply chain attack, involving two distinct phases between December 4-7, 2024, details how malicious versions of the AI library were published to PyPI. This attack exploited a template injection vulnerability in GitHub Actions, specifically within the `ultralytics/actions` workflow, allowing for the exfiltration of GitHub tokens and the distribution of a cryptocurrency mining payload (XMRig) for Monero. The malicious versions (8.3.41, 8.3.42, 8.3.45, and 8.3.46) were detected through unusual CPU usage and abuse detection systems like Google Colab. → snyk.io |
| 2026-06-15 2026 | Snyk Security Labs Testing Update: Cursor.com AI Code Editor intermediate 3 min read | Analysis of Cursor.com AI Code Editor by Snyk Security Labs details testing for dependency confusion vulnerabilities. Researchers uploaded intentionally named packages to the public NPM repository to test if Cursor's build system would mistakenly pull private extensions from the public registry. These packages exfiltrated system details such as username, hostname, and environmental variables to confirm installation. The analysis concluded that Cursor was not vulnerable to dependency confusion and no sensitive data was disclosed. → snyk.io |
| 2026-06-14 2026 | NPM 12 Redefines Script Execution and Dependency Security to Combat JavaScript Supply Chain Attacks beginner 5 min read | Library redefining JavaScript supply chain security, NPM 12 shifts from opt-out to opt-in for risky behaviors like executing lifecycle scripts and resolving Git dependencies. New defaults block automatic script execution from dependencies and prevent remote URL fetches unless explicitly allowed. Innovations include a "min-release-age" setting to mitigate rapidly published malicious packages and the `npm approve-scripts` command for granular script management, directly addressing past attacks involving vulnerabilities like those seen in eslint-config-prettier and the Shai-Hulud worm. → rescana.com |
| 2026-06-14 2026 | The Axios npm compromise was visible in registry metadata before anyone ran npm install news 3 min read | Library for automatically verifying package provenance during `npm install`. This approach catches supply chain attacks like the Axios npm compromise, where malicious versions were published without the expected trusted-publisher block or matching commit hashes. By automating a check for provenance mismatches, akin to comparing registry metadata against an established automated pipeline, this library flags suspicious packages before malicious code can execute, preventing similar compromises to the one involving malicious Axios versions 1.14.1 and 0.30.4. |
| 2026-06-14 2026 | s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know news 4 min read | Writeup detailing the s1ngularity supply chain attack, which leveraged malicious versions of the Nx build system npm package to steal developer secrets like cryptocurrency wallets, GitHub tokens, and SSH keys. The attack utilized AI command-line tools for reconnaissance and exfiltrated data to attacker-controlled GitHub repositories, with a subsequent phase involving the public release of over 5500 private repositories. The vulnerability exploited a flawed GitHub Actions workflow allowing code injection through unsanitized pull request titles combined with the `pull_request_target` trigger. → wiz.io |
| 2026-06-14 2026 | s1ngularity's Aftermath: AI, TTPs, and Impact in the Nx Supply Chain Attack intermediate 9 min read AI | Analysis of the s1ngularity supply chain attack reveals novel TTPs, including AI-powered malware that abuses GitHub Actions to leak thousands of corporate secrets and exfiltrate sensitive files. The malware specifically targets AI CLIs like Claude, Gemini, and Amazon Q to identify and collect data, and leverages leaked GitHub tokens to further expose private repositories. This incident highlights the significant impact of AI integration in malware and the evolving threat landscape of software supply chain compromises. → wiz.io |
| 2026-06-14 2026 | Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond news 6 min read | Writeup of a widespread npm supply chain attack impacting packages like debug and chalk, detailing how a wallet-hijacking browser interceptor was deobfuscated. The analysis quantifies a roughly two-hour exposure period with high package prevalence and a concerning malware presence, explaining the rapid spread through social engineering and malicious releases. Mitigation strategies involve updating lockfiles, rebuilding from clean caches, invalidating CDN assets, and hotfixing UI elements to prevent transaction redirection to attacker-controlled wallets. → wiz.io |
| 2026-06-14 2026 | Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware news 5 min read | Writeup detailing the Shai-Hulud npm supply chain attack, which involved malicious versions of popular packages spreading data-stealing malware worm-like across the ecosystem. The attack, believed to be a consequence of the s1ngularity/Nx compromise, leveraged a post-install script to harvest sensitive data using tools like TruffleHog, exfiltrate it to GitHub repositories, and propagate itself by publishing malicious package versions. The analysis includes compromised package names, compromised GitHub user data, and recommendations for revoking credentials. → wiz.io |
| 2026-06-14 2026 | Creating SBOMs with the Snyk CLI beginner 6 min read | Library for generating Software Bills of Materials (SBOMs) using the Snyk CLI. It supports various programming languages and package managers, creating SBOMs in CycloneDX, XML, or SPDX formats. The Snyk CLI can also scan existing SBOM files for known vulnerabilities and integrates with tools like Bomber for analysis. Automating SBOM generation within CI/CD pipelines is crucial for security, compliance, and transparency. → snyk.io |
| 2026-06-14 2026 | Do not pass GO - Malicious Package Alert news 2 min read | Library alert detailing a software supply chain compromise in the BoltDB Go Module. Version 1.3.1, released November 2021, was backdoored and remotely controllable via a command and control server. This typo squatting attack, named github.com/botdb-go/bolt, exploited Go Module Mirror's indefinite caching, allowing the malicious code to persist for years. Socket researchers reported the issue, leading to its removal from Go Module Proxy and GitHub, and inclusion in the Go vulnerability database. → snyk.io |
| 2026-06-14 2026 | Snyk Helps Secure the Golang Bento Project news 2 min read | Library contribution that fixes CVE-2025-22869, a denial-of-service vulnerability in golang.org/x/crypto/ssh, within the Golang Bento project. Snyk proactively addressed the issue by updating dependencies to secure versions, demonstrating their commitment to securing open-source projects through their Secure Developer Program. → snyk.io |
| 2026-06-14 2026 | Reconstructing the TJ Actions Changed Files GitHub Actions Compromise news 7 min read Secrets | Writeup on the tj-actions/changed-files GitHub Actions compromise, detailing how an attacker leveraged write privileges, orphaned Git commits, and manipulated release tags to inject malicious code. This code then exfiltrated encrypted secrets from memory and leaked them into public GitHub Action logs, impacting approximately 23,000 repositories. The analysis includes steps to recreate the attack and highlights remediation advice for users to review their logs. → snyk.io |
| 2026-06-13 2026 | NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks news 2 min read | Library update detailing changes in NPM version 12, set for July release, to mitigate supply chain attacks like TeamPCP and Shai-Hulud. This update will block automatic execution of preinstall, install, and postinstall scripts from dependencies by default. Developers can proactively manage script execution by using `npm approve-scripts` to create an allowlist for trusted packages, preventing vulnerabilities exploited through weaponized binding.gyp files and Git/remote URL dependencies. → securityweek.com |
| 2026-06-13 2026 | Free Compromise Detection for GitHub Repos - Tracebit Community Edition beginner 3 min read | Library that deploys AWS canary credentials and SSH key canaries within GitHub Actions to detect compromised repositories. This free tool installs in under five minutes, covers up to 10 repositories, and alerts users immediately if decoy credentials are touched, providing early detection against supply chain attacks like those seen with Trivy, KICS, LiteLLM, Telnyx, and tj-actions. |
| 2026-06-13 2026 | Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces intermediate 7 min read Secrets | Writeup of critical secrets leakage in VSCode IDE extensions impacting both the VSCode and Open VSX marketplaces. Over one hundred instances of leaked Azure DevOps Personal Access Tokens (PATs) and Open VSX Access Tokens were discovered, granting attackers the ability to distribute malicious updates to a combined install base of over 150,000 users. The leakage stemmed from publisher errors, such as bundling dotfiles and hardcoding secrets directly into extension code, affecting various categories including AI provider secrets, cloud platform credentials, and database secrets. Wiz collaborated with Microsoft to implement platform-level guardrails and notify affected publishers. → wiz.io |
| 2026-06-12 2026 | Atomic Arch npm Campaign Adds Malicious Dependency news 4 min read | Library for detecting supply chain attacks leveraging orphaned Arch User Repository (AUR) packages, exemplified by the "Atomic Arch" campaign (Sonatype-2026-003775). This campaign hijacks abandoned AUR projects to install malicious npm packages like `atomic-lockfile`, which subsequently deploy a sophisticated Linux payload. The payload includes credential harvesting, stealth capabilities via eBPF for process and file hiding, debugger detection, and data exfiltration functionality, potentially impacting numerous AUR packages. → sonatype.com |
| 2026-06-12 2026 | GitHub Enhances npm Security with Mandatory 2FA and Provenance to Combat Supply Chain Attacks news 5 min read | Library updates enhance npm security by enforcing mandatory two-factor authentication (2FA) for high-impact packages and introducing cryptographically verifiable package provenance via GitHub Actions and OpenID Connect (OIDC). These measures aim to combat supply-chain attacks by increasing account security and providing a trusted chain of custody for published packages, aligning with NIST SP 800-218. → rescana.com |
| 2026-06-12 2026 | Code to Cloud Attacks: From Github PAT to Cloud Control Plane news 7 min read Secrets | Library detailing attack flows where threat actors leverage compromised GitHub Personal Access Tokens (PATs) to gain initial access to cloud environments. It covers observed malicious techniques including secret discovery via code search API, execution of arbitrary code through GitHub Actions to exfiltrate credentials, and defense evasion via log deletion. The library also highlights lateral movement into cloud service provider control planes and supply-chain attack vectors like the tj-actions/changed-files compromise. → wiz.io |
| 2026-06-12 2026 | Cursor IDE Malware Extension Compromise in $500k Crypto Heist news 3 min read AI | Writeup detailing a compromise within Cursor IDE, a VS Code fork, where a malicious "Solidity Language" extension published on the Open VSX Registry led to a $500,000 cryptocurrency heist. The extension bundled a JavaScript file that executed a PowerShell script for exfiltration and crypto hijacking, highlighting risks associated with third-party IDE extensions and unofficial registries. → snyk.io |
| 2026-06-12 2026 | Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware news 3 min read | Writeup detailing an npm supply chain attack targeting maintainers of popular packages like `eslint-config-prettier` and `eslint-plugin-prettier`. Attackers used typosquatting on `npmjs.com` and spear-phishing to hijack npm registry credentials, leading to the publication of malware-infected versions. Remediation efforts included deprecating malicious packages and publishing fixes. Proactive measures to protect against such attacks include enabling 2FA on npm accounts, using tools like `npq`, and configuring `.npmrc` to ignore postinstall scripts. → snyk.io |
| 2026-06-12 2026 | Secure at Inception: Introducing New Tools for Securing AI-Native Development beginner 6 min read AI | Library for securing AI-native development, introducing three innovations for the entire code lifecycle. It empowers developers to embed Snyk's security testing into agentic workflows with tools like Cursor and Co-Pilot via the MCP Server, enabling automated vulnerability detection for AI-generated code. Additionally, the AI-BOM provides comprehensive visibility and governance for AI components, addressing "shadow AI," while Toxic Flow Analysis (TFA) proactively detects novel attack vectors in agentic systems. → snyk.io |
| 2026-06-12 2026 | Agentic Container Security with Snyk MCP Server intermediate 4 min read AI | Library for agentic container security, Snyk MCP Server automates the identification of Common Vulnerabilities and Exposures (CVEs) within container images. It integrates with AI tools and IDEs to shift container security left, allowing developers to scan and remediate vulnerabilities before committing Dockerfiles. The MCP Server supports operating system vulnerabilities and open-source package issues, complementing Snyk's broader offerings in SCA, SAST, and IaC scanning. → snyk.io |
| 2026-06-12 2026 | Prioritize with Snyk’s Open Source Vulnerability Experience intermediate 3 min read | Library view in Snyk's UI prioritizes open source vulnerability remediation by grouping issues by dependency. This new default view allows users to evaluate the holistic impact of library upgrades, moving beyond individual vulnerability fixes. It aids in making informed decisions by presenting a cost/benefit analysis of resolving multiple vulnerabilities with a single version update, supporting workflows for Maven, .NET, npm, Python, Ruby, and Yarn projects. → snyk.io |
| 2026-06-12 2026 | Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident news 6 min read AI | Analysis of the Nx malicious package incident details how attackers weaponized AI coding agents, including Claude Code, Gemini CLI, and Amazon's `q` command-line tool, via dangerous prompts (`--dangerously-skip-permissions`, `--yolo`, `--trust-all-tools`) to exfiltrate sensitive data like GitHub tokens, npm credentials, and SSH keys to public GitHub repositories. The attack, which involved malicious Nx and Nx Powerpack releases on npm and impacted the Nx Console VS Code extension, exploited a flawed GitHub Actions CI workflow and a compromised npm token. → snyk.io |
| 2026-06-12 2026 | Analyzing CVE-2026-32743: PX4 MAVLink Buffer Overflow DoS news | The analysis of CVE-2026-32743 highlights a critical vulnerability in PX4's MAVLink implementation, specifically a buffer overflow leading to a Denial of Service (DoS) attack. This is particularly concerning given the increasing use of autonomous drones in civilian sectors, which are now also potential targets in modern conflicts. The widespread deployment of commercial drones exposes a vulnerability in the global supply chain, where platforms used for agriculture and industry could be compromised. → infosecwriteups.com |
| 2026-06-12 2026 | [tl;dr sec] #332 - I've Joined OpenAI, fwd:cloudsec, AWS Well Architected Supply Chain Security news 10 min read Talks | Reference list of cloud security techniques, including GitHub token stealing via VSCode, Semgrep taint analysis optimization, Lambda Function URL abuse for command and control, and OIDC namespace recycling for hijacking cloud identities, alongside insights on AI vendor evaluation and AWS Well-Architected Supply Chain Security. → tldrsec.com |
| 2026-06-12 2026 | npm v12 delivers one of the biggest security improvements in years news 5 min read | Library update npm v12 will block dependency install scripts by default, significantly reducing supply chain attack vectors like Nx s1ngularity and Shai-Hulud, which exploited postinstall scripts. This change requires explicit approval for scripts via `npm approve-scripts` and also blocks implicit code execution from `binding.gyp` and insecure Git/remote-URL dependencies by default. The update, already available behind warnings in npm 11.16.0, aims to protect users who don't review package changes. → aikido.dev |
| 2026-06-12 2026 | Trust No Skill: Integrity Verification for AI Agent Supply Chains intermediate 8 min read AI | Library for Behavioral Integrity Verification (BIV) to audit AI agent skills, comparing declared metadata against executable code and natural-language instructions. BIV analyzes skills from registries like OpenClaw, identifying deviations that can range from documentation gaps to multi-stage attack chains for credential theft and remote code execution (RCE). It categorizes threats into network, file system, process execution, environment, encoding, credentials, and instruction-level threats, and differentiates between developer oversight and adversarial intent. → unit42.paloaltonetworks.com |
| 2026-06-11 2026 | GitHub Disables npm Install Scripts by Default in v12 to Prevent JavaScript Supply Chain Attacks news 6 min read | Library update disabling npm install scripts by default in v12 to mitigate JavaScript supply chain attacks like Shai-Hulud, Nx, and event-stream. This change enforces explicit trust, requiring developers to approve script execution and aligning npm with Yarn and pnpm. Additional security measures include stricter authentication, granular tokens, and trusted publishing, addressing risks from malicious transitive dependencies and improving compliance with regulations like the EU Cyber Resilience Act. → rescana.com |
| 2026-06-11 2026 | NetRise launches Discovery Partner Program to strengthen software supply chain security delivery news 2 min read | Program NetRise's Discovery Partner Program is a partner-first initiative designed to expand access to NetRise solutions through value-added resellers, MSSPs, distributors, technology alliances, and strategic consultants. The program aims to provide partners with the expertise, training, and enablement needed to deliver strategic and implementation support for software supply chain security, helping organizations assess, manage, prioritize, and reduce software risk. It includes channel and distribution growth, technology ecosystem alliances, and federal and strategic consulting partnerships, with partner-enabled services ranging from third-party risk reporting to attack surface management audits. |
| 2026-06-11 2026 | RapidFort Launches Curated Libraries to Stop Supply Chain Attacks Before They Reach the Pipeline news | RapidFort has launched curated libraries designed to prevent software supply chain attacks. These libraries aim to identify and neutralize malicious code within open-source software before it enters development pipelines. By offering pre-vetted and secured components, RapidFort empowers developers to build software more safely and efficiently, reducing the risk of breaches originating from compromised third-party libraries. |
| 2026-06-11 2026 | GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks news 2 min read | Reference detailing changes in npm version 12, disabling install scripts by default to prevent software supply chain attacks. This update modifies behavior around preinstall, install, and postinstall scripts, Git dependencies, and remote URLs to require explicit user approval for code execution. Developers can prepare by upgrading to npm 11.16.0 or newer and using `npm approve-scripts --allow-scripts-pending` to manage trusted package scripts. → thehackernews.com |
| 2026-06-11 2026 | JFrog and Anthropic Bring Enterprise-Grade Software Supply Chain Governance and Security to Claude Code news 2 min read | Platform plugin for Claude Code that integrates JFrog's trusted, universal, multi-agent platform, enabling enterprise-grade software supply chain governance and security for AI coding agents. This collaboration addresses the evolving attack surfaces of capable agents by providing controlled access to scan, curate, and secure artifacts and dependencies, thus mitigating risks from malicious packages and ungoverned AI assets within the software supply chain. The integration aims to provide a system of record with real-time control and visibility into agent decisions, supporting Agentic DevSecOps. |