# Supply chain attacks expose weaknesses in open-source software trust

DevFeed: [Supply chain attacks expose weaknesses in open-source software trust](<https://devfeed.tech/articles/open-source-died-in-march-it-just-doesn-t-know-it-yet-13195.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/open-source-died-in-march-it-just-doesnt-know-it-yet>)

Published: 2026-04-09T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Open Source](<https://devfeed.tech/topics/open-source.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [npm](<https://devfeed.tech/topics/npm.md>)

Tags: [ai-coding](<https://devfeed.tech/tags/ai-coding.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [code](<https://devfeed.tech/tags/code.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [npm](<https://devfeed.tech/tags/npm.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [oss](<https://devfeed.tech/tags/oss.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [scanner](<https://devfeed.tech/tags/scanner.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [solarwinds](<https://devfeed.tech/tags/solarwinds.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [trust](<https://devfeed.tech/tags/trust.md>), [vibe-coding](<https://devfeed.tech/tags/vibe-coding.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-scanner](<https://devfeed.tech/tags/vulnerability-scanner.md>)

## AI overview

This opinion article argues that a series of open-source supply chain attacks exposed a broken trust model. It discusses attacks involving npm and PyPI packages, stolen credentials, malicious contributors, and the limits of vulnerability scanning and hardening.

## Source excerpt

Five supply chain attacks in 12 days exposed a broken trust model. Learn why scanning and hardening fail, and why trusting the source is the only fix.