Software Supply Chain Security

June 30, 2026

npm Is Fighting the Right War With the Wrong Weapons

• 

Moshe Siman Tov Bustan

June 24, 2026

Preventing Future Supply Chain Attacks: The OX Guide to Version Pinning, Installation Cooldown, and Defense in Depth

• 

OX Security

June 17, 2026

OX Security Joins Anthropic’s Cyber Verification Program

• 

Enosh Alter

June 4, 2026

Malware-Slop 2: Malicious npm Package Leaks Its Own Bot’s Telegram Private Token

• 
• 

Moshe Siman Tov Bustan, Nir Zadok

June 4, 2026

600,000 Monthly Downloads Affected: Miasma Supply Chain Attack Is Back on npm

• 
• 

Moshe Siman Tov Bustan, Nir Zadok

June 3, 2026

IronWorm Supply Chain Malware Hits npm

• 

Moshe Siman Tov Bustan

June 2, 2026

Six Stages Deep and an Endless Loop: Shai-Hulud Is Getting Sophisticated

• 
• 

Moshe Siman Tov Bustan, Nir Zadok

June 1, 2026

New Shai-Hulud hits npm: @redhat-cloud-services Compromised

• 
• 

Moshe Siman Tov Bustan, Nir Zadok

May 27, 2026

Malware-Slop: New Malicious npm Package Leaks Its Own GitHub Private Token

• 
• 

Moshe Siman Tov Bustan, Nir Zadok

May 21, 2026

Megalodon: New CI/CD Malware Spreads Across GitHub, Infecting ~5,000+ Repositories

• 

Moshe Siman Tov Bustan

May 20, 2026

North Korean-Linked Threat Actor Targets Developers with New npm Infostealer RAT

• 
• 

Moshe Siman Tov Bustan, Nir Zadok

May 20, 2026

TeamPCP Strikes (again): How a Trojan VS Code Extension Brought Down GitHub

• 

Nir Zadok