// supply chain security

All signals tagged with this topic

Oct 28

Data Center Theft Ring Targets $100M in US Freight Since June

Organized crime has shifted focus to data center infrastructure, with thieves executing coordinated attacks on armored escorts to steal high-value server equipment and components worth tens of millions. This reflects a maturing criminal market responding to supply chain vulnerabilities in the AI and cloud infrastructure boom—individual shipments now carry replacement value comparable to drug trafficking operations, creating financial incentives for professionally organized theft rings. The targeting of armed convoys signals that criminal sophistication has outpaced security protocols designed for traditional cargo, forcing data center operators and logistics providers to redesign asset protection across the supply chain.

theme-connected supply chain security infrastructure vulnerability npm ecosystem

Jul 15

Attackers compromised multiple AsyncAPI npm packages in coordinated supply chain raid

Source: The Next Web

Upwind's investigation reveals that threat actors exploited the npm release process itself rather than individual package vulnerabilities. They gained access to legitimate developer credentials and published malicious versions of widely-trusted AsyncAPI libraries that developers would naturally download without suspicion. The compromise targeted established projects with thousands of weekly downloads—core infrastructure that enterprise teams rely on, not marginal risk. Official package repositories lack sufficient verification mechanisms between credential compromise and code publication, making the npm release process an increasingly attractive target for attackers seeking scale.

theme-connected supply chain security infrastructure vulnerabilities developer tools

May 1

Supply chain attackers now targeting SAP and npm developer tools

Source: The Register

Attackers are shifting from infrastructure to the tools developers use daily. Stealing credentials from SAP systems and npm packages penetrates deeper into enterprise operations than previous tactics. A compromised dependency can distribute malware across thousands of downstream projects at once, forcing organizations to treat their development toolchain as a security perimeter, not an engineering convenience. The targeting of both enterprise software and open-source package managers shows attackers are weaponizing the entire developer ecosystem simultaneously.