supply chain attack

Jun 19

Hacker group exploited open source trust to poison 1,000+ packages

TeamPCP's attack exposes a structural vulnerability in how developers distribute code. By compromising packages at the source rather than targeting individual users, they achieved scale impossible through traditional malware vectors. The attack shows that code repositories—long assumed to be trustworthy intermediaries—are now a viable attack surface. Enterprises will need to shift from verification-by-incident to verification-by-default in their dependency management.

theme-connected infrastructure security supply chain attack package management

May 12

Major npm packages compromised in Mini Shai-Hulud supply chain attack

Source: Socket

The compromise of packages serving Mistral, UiPath, and TanStack (including react-router) shows how attackers can weaponize the dependency tree itself. When developers pull in trusted tools, they now pull in malicious code at scale. Socket attributes the attack to the "Mini Shai-Hulud" campaign, suggesting coordinated targeting of high-visibility infrastructure packages. The attack surface isn't just enterprise software but the open-source foundations powering millions of applications simultaneously. Supply chain attacks have moved from theoretical risk to operational crisis for any organization using these ubiquitous libraries.