Tag
8 articles tagged #Supply Chain.
P.01Two unrelated companies disclosed breaches in the same week, both tracing back to a vulnerability in Metabase, the business intelligence tool their vendors used. Here's what happened, how it lines up with the CVE we covered days earlier, and what to actually check.
P.02The keyv and cacheable attack poisoned 2,234 package versions in one day, and it won't be the last. Here's the concrete checklist for install scripts, provenance, lockfile audits, and CI token scoping that actually reduces your exposure.
P.03A compromised maintainer account on August 4 turned keyv and cacheable into a self-propagating npm worm that stole cloud, CI, and GitHub credentials from packages with tens of millions of weekly downloads. Here's what happened and how to check if you were hit.
P.04pnpm versions before 10.34.0 and 11.4.0 could send your unscoped npm auth token to whatever registry a repository's .npmrc pointed at. Here's how the leak works, who's exposed, and how to check and fix it.
P.05Three malicious gems published from a hijacked, six-year-dormant RubyGems account are checking for CI environment variables and refusing to run there, targeting developer machines instead. Here's what SleeperGem does and how to check if you pulled it.
P.06On July 11, 2026, attackers used a stolen publishing credential to push five malicious versions of the jscrambler npm package, each carrying a 7.8MB cross-platform infostealer. Here's what it stole and how to check if you're affected.
P.07Strip away the crypto speculation and NFT mania. What is left of Web3 in 2026? Turns out, quite a lot — supply chain tracking, digital identity, smart contracts, and decentralized storage are quietly solving real problems.
P.08Supply chain attacks have surged 742% since 2019. SBOMs are now legally mandated for federal software and EU market access. Here is how to implement them without slowing down your CI/CD pipeline.