Mini Shai-Hulud is an npm supply-chain attack that compromised @antv packages to steal CI/CD credentials from JavaScript development pipelines.
This post examines the Mini Shai-Hulud npm supply chain attack, where hundreds of packages were compromised through typosquatting and dependency confusion, and outlines practical defenses for maintainers and developers.
GitHub’s breach via a malicious VS Code extension shows how compromised developer endpoints can expose internal repositories and cascade into broader supply chain risk.
A GitHub Actions supply-chain attack redirected mutable version tags to attacker-controlled commits, enabling credential theft from CI/CD workflows that relied on unpinned actions.
Grafana’s GitHub token breach shows how a CI/CD secret leak can expose source code, enable extortion, and turn pipeline weakness into a supply chain security incident.
A counterfeit npm package campaign tied to the TanStack incident compromised employee devices at OpenAI and Mistral, exposing internal repositories and highlighting the risks of open-source supply chain attacks.
A large-scale npm supply chain attack weaponized 170 packages to exfiltrate GitHub, AWS, and Kubernetes credentials from developers and organizations.
A supply-chain attack compromised 84 TanStack npm packages, using SLSA-attested malware to target CI credentials and expose weaknesses in build integrity controls.
A security-focused analysis of fake DeepSeek TUI GitHub repositories used to distribute malware, with practical guidance for spotting typosquatting and verifying open-source dependency trust.
The Bitwarden CLI npm compromise briefly exposed users who installed @bitwarden/[email protected] during a narrow April 22, 2026 window and prompted immediate uninstall, cache cleanup, script hardening, and secret rotation steps.
A practical guide to securing the AI supply chain by validating model integrity and detecting tampering risks.
An exploration of how using software components with known vulnerabilities creates hidden supply chain risks and what teams can do to reduce exposure.
A 2026 security incident shows how a compromised AI tool and stolen OAuth access enabled intrusions into internal systems and exposed non-sensitive environment variables, reinforcing the need for MFA, secret rotation, and tighter supply-chain controls.