📊 In the last day: 14 malicious packages caught across npm, ahead of the public advisory. We were first on 43%.

#malware #supplychainsecurity #opensource

🚀 US Backs Kenya Rare-Earth Processing as China Rivalry Deepens
🔎 Read the full update:
➡️https://theminingnews.com/us-backs-kenya-rare-earth-processing-as-china-rivalry-deepens/
#USKenyaRelations #RareEarths #CriticalMinerals #RareEarthProcessing #ChinaRivalry #SupplyChainSecurity #KenyaM

⏱ We flagged npm @fyxzpediaa/[email protected] 5 days before the public advisory landed (MAL-2026-16070).

#flaggedfirst #npm #malware #supplychainsecurity

📊 In the last day: 27 malicious packages caught across npm and pypi, a median 1 day ahead of the public advisory. We were first on 50%.

#malware #supplychainsecurity #opensource

Security training has become a ritual: click through, pass the quiz, collect the badge, move on.

Breach does the opposite.

It's a supply chain attack you run yourself.

Free. Open source. Security awareness you play.

#SupplyChainSecurity #DevSecOps #OpenSource #CyberSecurity #CTF

armornet.io

GitHub folded Dependabot into the same token model as Actions — no more PATs for private registry access. Small change, real cleanup for anyone managing GitHub Packages.
devops.com/github-quiet... #SupplyChainSecurity #GitHub

npm-Lieferkettenangriffe abwehren: Was wirklich hilft

Das npm-Ökosystem hat sich 2026 stark verändert. Was jetzt standardmäßig sicher ist, was Sie diese Woche selbst einschalten sollten und welche Lücken weiterhin ganz bei Ihnen…

#npmlieferkettenangriff #supplychainsecurity #trustedpublishing

npm Supply Chain Attack Mitigation: What Actually Works

The npm ecosystem changed a lot during 2026. What is now secure by default, what is opt-in and worth turning on this week, and which gaps are still entirely yours to close.

#npmsupplychainattack #supplychainsecurity #trustedpublishing

⏱ We flagged npm @usemosaik/[email protected] 3 days before the public advisory landed (MAL-2026-16047).

#flaggedfirst #npm #malware #supplychainsecurity

📊 In the last day: 1 malicious package caught across npm, a median 3 days ahead of the public advisory. We were first on 33%.

#malware #supplychainsecurity #opensource

📈 Our week: 123 malicious packages flagged across the ecosystems, npm the hottest, typically 0 days before the advisory landed.

#malware #supplychainsecurity #opensource

🚀 Critical Minerals Partnerships Reshape the Geopolitics of Western Supply Chains
🔎 Read the full update:
➡️https://theminingnews.com/critical-minerals-partnerships-reshape-the-geopolitics-of-western-supply-chains/
#CriticalMinerals #Geopolitics #SupplyChainSecurity #ResourceDiplomacy #Min

Edition 023: gateways that proxy for intruders, a 33 hour BGP poisoned update, 444 npm packages, and 153 million licenses.

Full Inferlume Nightwatch report: inferlume.com/reports/nigh...

#ThreatIntelligence #CTI #PotatoSecurity #SupplyChainSecurity #IdentitySecurity #ZeroDay #NightWatch

Edition 023: gateways that proxy for intruders, a 33 hour BGP poisoned update, 444 npm packages, and 153 million licenses.

Full Inferlume Nightwatch report: inferlume.com/reports/nigh...

#ThreatIntelligence #CTI #CyberSecurity #SupplyChainSecurity #IdentitySecurity #ZeroDay #NightWatch

🚀 Critical Minerals Partnerships Reshape the Geopolitics of Western Supply Chains
🔎 Read the full update:
➡️https://miningir.com/critical-minerals-partnerships-reshape-the-geopolitics-of-western-supply-chains/

#CriticalMinerals #ResourceDiplomacy #Geopolitics #SupplyChainSecurity #EnergyT

⏱ We flagged pypi [email protected] 1 hour before the public advisory landed (MAL-2026-15934).

#flaggedfirst #PyPI #malware #supplychainsecurity

📊 In the last day: 1 malicious package caught across pypi, ahead of the public advisory. We were first on 33%.

#malware #supplychainsecurity #opensource

Your threat feed is someone else’s database: What ingesting malware intel at scale takes

🔗 Read more: www.helpnetsecurity.com/2026/09/03/g...

#CyberSecurity #ThreatIntel #SupplyChainSecurity

Microsoft will require a Windows driver SBOM and VEX statement for signing from March 2027, aligning WHCP with the EU CRA.

#Windows #SBOM #VEX #WHCP #CyberResilienceAct #DriverSecurity #SupplyChainSecurity