We just found an npm supply-chain campaign that's already earned attackers 109 ETH (~€230,933) — and it doesn't use `postinstall`. `indexed-btree` mimics sorted-btree library, has hit 2M weekly downloads.

Full writeup with all IOCs: buff.ly/9MVuuS0

#AppSec #SupplyChainSecurity #npm

Seattle's city officials are pushing for stronger vendor-ethics standards and improved supply-chain security to safeguard city data from vulnerabilities.

Click to read more!

#SeattleKingCounty #WA #CitizenPortal #CybersecurityStandards #VendorAccountability #SupplyChainSecurity

⏱ Caught early: npm [email protected] was on our radar 2 days before MAL-2026-16220 went public.

#flaggedfirst #npm #malware #supplychainsecurity

📊 In the last day: 15 malicious packages caught across npm and pypi, ahead of the public advisory. We were first on 55%.

#malware #supplychainsecurity #opensource

⏱ 2 days of lead time on npm [email protected]: we flagged it, then MAL-2026-16148 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity

📊 In the last day: 1 malicious package caught across npm, ahead of the public advisory. We were first on 100%.

#malware #supplychainsecurity #opensource

📈 This week npm was the most-targeted ecosystem we saw: 130 malicious packages caught, a median 0 days before their public advisories.

#malware #supplychainsecurity #opensource

Learn how businesses can reduce supply chain theft and tampering in 2026 using security seals, tracking, chain-of-custody controls, and staff training. Read more.
sealshq.blogspot.com/2026/09/redu...

#supplychainsecurity #cargosecurity #securityseals #tamperevidentseals #logisticssecurity

3 JFrog Artifactory CVEs. All patched. All are still being exploited weeks later. Wiz found attackers chaining bugs to grab admin access, then dropping Rust backdoors and web shells. Patch your build pipeline.
devops.com/more-jfrog-a... #DevSecOps #SupplyChainSecurity #CVE #InfoSec

Unauthenticated root on firewall manager. 0-day kit with 4 espionage customers. Admin tokens from anonymous POST. Passkey call that ends in your SharePoint. Read weekly wrap-up here: inferlume.com/reports/nigh...

#CyberThreatIntelligence #PatchTuesday #AISecurity #SupplyChainSecurity #KEV #Defence

📝 Neuer Blog-Beitrag: Supply Chain Security 2026: SBOM, Sigstore/SLSA und Admission Control als DevOps-Standard

Software-Lieferkettenangriffe kosten 80,6 Mrd. US-Dollar jährlich. Wie SBOMs, Sigstore keyless Signing, SLSA Build-Integrität und Kubernet…

#DevOps #SupplyChainSecurity #Sigstore

⏱ We flagged npm [email protected] 13 hours before the public advisory landed (MAL-2026-16137).

#flaggedfirst #npm #malware #supplychainsecurity

📊 In the last day: 5 malicious packages caught across npm, ahead of the public advisory. We were first on 38%.

#malware #supplychainsecurity #opensource

⏱ under an hour of lead time on npm [email protected]: we flagged it, then MAL-2026-16126 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity

📊 In the last day: 1 malicious package caught across npm, ahead of the public advisory. We were first on 33%.

#malware #supplychainsecurity #opensource

OpenAI's AI agents went rogue, hacked Hugging Face, and grabbed admin access to 41 servers in under 13 hours. It's a warning shot for the entire industry. jpmellojr.blogspot.com/2026/09/open... #AIsecurity #OpenAI #SupplyChainSecurity #HuggingFace

⏱ Caught early: npm @neroxkira/[email protected] was on our radar 11 days before MAL-2026-16103 went public.

#flaggedfirst #npm #malware #supplychainsecurity