1.tensorlake NPM package compromised with Shai Hulud wormblog | 2026-10-08 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #supply-chain | #npm
2.PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Huntingresearch | 2026-09-15 00:00 | crowdstrike.com | Original ↗ | .md | #ai-security | #bug-bounty | #supply-chain
3.Shai-Hulud Rises From the Dead after 111 daysblog | 2026-09-07 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #malware | #npm
4.Popular code generator for TanStack Query hit by supply chain wormincident | 2026-08-28 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #threat-intelligence | #malware
5.Good riddance, TeamPCP. Now for the hard part.blog | 2026-08-27 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #threat-intelligence | #malware
6.Coding Agents Just Reopened Your Software Supply Chain Blind Spotblog | 2026-08-25 12:36 | jfrog.com | Original ↗ | .md | #ai-security | #supply-chain | #npm
7.Shai-Hulud was the best thing to happen to supply chain securityblog | 2026-08-24 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #npm | #aikido
8.From DEF CON Research to Automated Supply Chain Defense, finding npx confusion vulnerabilities with npxconfuseresearch | 2026-08-11 00:00 | lab.ctbb.show | Original ↗ | .md | #rce | #supply-chain | #zero-day
9.keyv and cacheable npm Package Hijacked in Supply Chain Attackincident | 2026-08-04 11:25 | wiz.io | Original ↗ | .md | #ai-security | #supply-chain | #malware
10.Keyv and friends compromised in active Shai-Hulud supply chain attackincident | 2026-08-04 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #incident-response | #malware
11.Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacksresearch | 2026-07-21 00:00 | crowdstrike.com | Original ↗ | .md | #ai-security | #supply-chain | #featured
12.AsyncAPI npm packages backdoored via GitHub Actionsincident | 2026-07-14 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #featured | #incident-response
13.Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetryincident | 2026-07-09 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #web3 | #featured
14.The upgrade trap: when upgrading is the wrong answer to a CVEblog | 2026-07-20 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #vulnerability-management | #open-source
15.M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actionsincident | 2026-07-14 10:33 | wiz.io | Original ↗ | .md | #supply-chain | #malware | #github-actions
16.npm now freezes high-impact accounts after risky account changesblog | 2026-06-26 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #open-source | #developer-security
17.Everybody's shipping code they can't readblog | 2026-06-25 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #supply-chain | #open-source
18.Compromised GitHub action codfish/semantic-release-action steals CI/CD secretsblog | 2026-06-24 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #devsecops | #secrets
19.Aikido x Drydock | A way for maintainers to catch malware before it shipsblog | 2026-06-23 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #devsecops | #open-source
20.Over 140 popular Mastra npm Packages Hit by Supply Chain Attackincident | 2026-06-17 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #supply-chain | #open-source
21.npm v12’s Biggest Security Change: From Implicit to Explicit Trustblog | 2026-06-18 14:15 | jfrog.com | Original ↗ | .md | #supply-chain | #npm | #javascript
22.npm v12 delivers one of the biggest security improvements in yearsblog | 2026-06-11 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #devsecops | #open-source
23.Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build Systemblog | 2026-06-09 00:00 | aikido.dev | Original ↗ | .md | #cloud | #supply-chain | #malware
24.Miasma: Supply Chain Attack Targeting RedHat npm Packagesincident | 2026-06-01 12:45 | wiz.io | Original ↗ | .md | #cloud | #supply-chain | #malware
25.Why EDR and proxy won’t save you from supply chain malwareblog | 2026-06-02 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #malware | #npm
26.Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokensblog | 2026-05-27 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #supply-chain | #malware
27.The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Waveblog | 2026-05-19 08:29 | wiz.io | Original ↗ | .md | #supply-chain | #malware | #credential-theft
28.Shai Hulud and Looking Into the Deep End of Supply Chain Mayhemblog | 2026-05-16 00:00 | abdulmhsblog.com | Original ↗ | .md | #supply-chain | #credential-theft | #npm
29.Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstackblog | 2026-05-12 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #supply-chain | #malware
30.Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromisedblog | 2026-05-12 01:38 | wiz.io | Original ↗ | .md | #ai-security | #supply-chain | #malware