Curated security research, vulnerabilities, advisories and tools for practitioners.

#supply-chain-attack

Security coverage tagged supply-chain-attack.

1.

Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets

blog | 2026-06-24 00:00 | aikido.dev | original ↗ | #supply-chain | #devsecops | #secrets

2.

Over 140 popular Mastra npm Packages Hit by Supply Chain Attack

incident | 2026-06-17 00:00 | aikido.dev | original ↗ | #ai-security | #supply-chain | #open-source

3.

Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System

blog | 2026-06-09 00:00 | aikido.dev | original ↗ | #cloud | #supply-chain | #malware

4.

Miasma: Supply Chain Attack Targeting RedHat npm Packages

incident | 2026-06-01 12:45 | wiz.io | original ↗ | #cloud | #supply-chain | #malware

5.

Delivered by Trust: What the Axios Supply Chain Attack Means for Security Leaders

incident | 2026-04-06 00:00 | bishopfox.com | original ↗ | #supply-chain | #incident-response | #npm

6.

Shifting Security ‘Lefter’ Than Left Is The Key To Avoiding Risky Packages

blog | 2025-09-19 20:01 | jfrog.com | original ↗ | #npm | #jfrog | #supply-chain-attack

7.

New compromised packages identified in largest npm attack in history

blog | 2025-09-09 13:51 | jfrog.com | original ↗ | #malware | #npm | #phishing

8.

RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)

blog | 2025-05-06 00:00 | aikido.dev | original ↗ | #supply-chain | #malware | #npm

9.

XRP supply chain attack: Official NPM package infected with crypto stealing backdoor

incident | 2025-04-22 00:00 | aikido.dev | original ↗ | #supply-chain | #cryptocurrency | #npm

10.

Get the TL;DR: tj-actions/changed-files Supply Chain Attack

incident | 2025-03-16 00:00 | CVE-2025-30066 | aikido.dev | original ↗ | #supply-chain | #incident-response | #github-actions

11.

110,000 sites affected by the Polyfill supply chain attack

incident | 2024-06-27 00:00 | aikido.dev | original ↗ | #supply-chain | #incident-response | #malware

12.

All about the xz-utils backdoor

vulnerability | 2024-03-29 00:00 | CVE-2024-3094 | kali.org | original ↗ | #incident-response | #linux | #vulnerability

13.

Tracking a stolen code-signing certificate with osquery

blog | 2017-10-10 12:53 | blog.trailofbits.com | original ↗ | #supply-chain | #incident-response | #malware