# software supply-chain attack Published articles for software supply-chain attack. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain DevFeed: [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain]() Original publisher: [Read original article]() Author: Yaron Avital Published: 2026-08-21T23:00:21Z Content type: article Language: en Sources: [Unit 42]() Topics: [sdlc](), [Security](), [Application Security](), [CI/CD](), [GitHub Actions](), [npm](), [Bun](), [Python](), [Claude Code](), [vs-code](), [Claude](), [Ethereum]() Tags: [blockchain](), [c2](), [chaindrop](), [ci-cd](), [claude-code](), [general](), [github-actions](), [insights](), [malware](), [npm-packages](), [persistence](), [python](), [sdlc](), [security](), [software-supply-chain-attack](), [supply-chain](), [vs-code]() ### AI overview Unit 42 describes how software supply-chain attackers are targeting developer tools, CI/CD pipelines, accounts, packages, setup scripts and developer environments before software reaches production. It examines the ChainDrop npm worm, which used malicious preinstall hooks, a Bun runtime, an obfuscated payload, Python-based memory theft, stolen tokens and secrets, self-propagation, persistence in VS Code and Claude Code, and Ethereum-managed command-and-control infrastructure. ### Source excerpt Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42. ## Chainguard Libraries now available on AWS Security Hub Extended DevFeed: [Chainguard Libraries now available on AWS Security Hub Extended]() Original publisher: [Read original article]() Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [AWS Security Hub](), [Security](), [software supply-chain attack](), [Malware](), [Open Source](), [Amazon Web Services]() Tags: [ai-coding](), [aws-security-hub](), [axios](), [chainguard-libraries](), [dependencies](), [java](), [javascript](), [litellm](), [malware](), [mini-shai-hulud](), [npm](), [open-source](), [python](), [redhat](), [redhat-cloud-services](), [security](), [shai-hulud](), [software-supply-chain](), [software-supply-chain-attack](), [telnyx]() ### AI overview Chainguard Libraries is now available through AWS Security Hub Extended's Supply Chain category. The article presents it as a malware-free catalog of Python, Java, and JavaScript dependencies intended to reduce reliance on public registries and help protect AWS workloads from software supply-chain attacks. ### Source excerpt Chainguard Libraries is now available in AWS Security Hub Extended, delivering malware-resistant open source dependencies for AWS workloads. ## The Mastra AI Ecosystem Was Poisoned At The Registry Level DevFeed: [The Mastra AI Ecosystem Was Poisoned At The Registry Level]() Original publisher: [Read original article]() Author: Roshan Piyush Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [software supply-chain attack](), [npm packages](), [Malware](), [Artificial Intelligence](), [CI/CD](), [TypeScript](), [Cloud]() Tags: [ai](), [ci-cd](), [malicious-packages](), [malware](), [mastra](), [npm](), [npm-packages](), [software-supply-chain](), [software-supply-chain-attack](), [typescript]() ### AI overview The article examines a June 17, 2026 software supply-chain attack targeting the Mastra AI TypeScript ecosystem. It reports that a compromised contributor account was used to publish 144 malicious packages under the official @mastra npm scope, with registry-level changes introducing the easy-day-js transitive dependency. Installations during the compromise window could expose developer workstations, CI/CD runners, and cloud environments to an information stealer. ### Source excerpt Learn how the Mastra AI supply chain attack poisoned npm packages, impacted AI pipelines, and how Harness SCS helps detect, block, and remediate compromised dep | Blog ## Our response to the TanStack npm supply chain attack DevFeed: [Our response to the TanStack npm supply chain attack]() Original publisher: [Read original article]() Published: 2026-05-13T00:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [OpenAI](), [npm](), [supply-chain-security](), [software supply-chain attack](), [Incident response](), [Security](), [Digital forensics](), [macOS](), [Malware](), [App]() Tags: [app](), [incident-response](), [macos](), [malware](), [open-source](), [openai](), [security](), [software-supply-chain-attack](), [supply-chain]() ### AI overview OpenAI describes its response to the TanStack npm supply-chain attack known as Mini Shai-Hulud. The article outlines the investigation, containment measures, certificate protections for macOS applications, and required application updates. ### Source excerpt OpenAI details its response to the TanStack "Mini Shai-Hulud" supply chain attack, outlines protections taken to secure systems and signing certificates, and explains why macOS users must update OpenAI apps by June 12, 2026. Learn what happened, what was affected, and how OpenAI is strengthening defenses against evolving software supply chain threats. ## Our response to the Axios developer tool compromise DevFeed: [Our response to the Axios developer tool compromise]() Original publisher: [Read original article]() Published: 2026-04-10T00:00:00Z Content type: news Language: en Sources: [OpenAI News]() Topics: [OpenAI](), [software supply-chain attack](), [macOS](), [Security](), [GitHub Actions](), [ChatGPT](), [codex](), [Command-line interface]() Tags: [apps](), [chatgpt](), [cli](), [codex](), [github-actions](), [macos](), [openai](), [security](), [software-supply-chain-attack]() ### AI overview OpenAI describes its response to the compromise of the Axios developer library in a broader software supply-chain attack. The company found no evidence of user-data access, system or intellectual-property compromise, or altered software, but is revoking and rotating the macOS application-signing certificate as a precaution. Users must update ChatGPT Desktop, Codex App, Codex CLI, and Atlas by May 8, 2026. ### Source excerpt OpenAI responds to the Axios supply chain attack by rotating macOS code signing certificates, updating apps, and confirming no user data was compromised. ## Detecting Maven-Hijack-style risks in Gradle builds with the Dependency Analysis Gradle Plugin DevFeed: [Detecting Maven-Hijack-style risks in Gradle builds with the Dependency Analysis Gradle Plugin]() Original publisher: [Read original article]() Author: Laura Kassovic Published: 2025-12-08T05:00:00Z Content type: tutorial Language: en Sources: [The Gradle Blog]() Topics: [Gradle](), [supply-chain-security](), [software supply-chain attack](), [Java](), [Vulnerabilities]() Tags: [dependency](), [gradle](), [gradle-plugin](), [java](), [software-supply-chain](), [software-supply-chain-attack](), [supply-chain-security](), [vulnerabilities]() ### AI overview This tutorial explains how Maven-Hijack-style attacks exploit duplicate fully qualified class names, deterministic Maven packaging order, and JVM classloader behavior in Java builds. It presents DAGP 3.5.0, the Dependency Analysis Gradle Plugin, as a defense that warns about duplicate classes and checks binary compatibility to identify potentially ambiguous bytecode. ### Source excerpt JVM builds have lived with "duplicate classes on the classpath" for years. Most of the time, it's an annoying source of NoSuchMethodError or a "why did production suddenly break when I reordered dependencies?" kind of bug. A recent academic paper, Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order, shows that this isn't just a reliability problem, it's also a supply-chain security problem. DAGP 3.5.0 (Dependency Analysis Gradle Plugin), a popular community plugin, now provides another line of defense: in addition to warning you about duplicate classes, it checks binary compatibility when it finds them. That means it can spot cases where "the same class name" actually refers to different bytecode, which is exactly the kind of ambiguity Maven-Hijack exploits. We'll explore how to use DAGP to protect against Maven-Hijack style attacks in Gradle builds. If you've heard about supply chain vulnerabilities in the npm / Nx ecosystem, we've also written about how Continuous GRC can help block compromised packages across your org. What Maven-Hijack actually does The Maven-Hijack paper describes a class of attacks that rely on two facts about the Java ecosystem: Maven packaging order is deterministic - When building an uber-JAR, Maven walks the dependency tree in depth-first order and packages classes in that order. Dependencies earlier in that traversal "win" when there are duplicates. The JVM classloader loads the first matching class on the classpath - At runtime, the Java classloader linearly scans the classpath and loads the first class whose fully-qualified name matches the one being requested. That's enough to build an attack: The attacker finds a gadget dependency, a library that contains a class they'd love to hijack (e.g., a JDBC driver or some other central integration point). They then compromise or control an infection dependency that appears earlier in the dependency tree and publish a new version that contains a class with the same fully quali ## Enabling Secure Software Development in 2025 DevFeed: [Enabling Secure Software Development in 2025]() Original publisher: [Read original article]() Published: 2025-01-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [open-source-security](), [supply-chain-security](), [container images](), [Containers](), [vulnerability](), [DevOps]() Tags: [2025](), [chainguard](), [chainguard-customers](), [chainguard-images](), [container-images](), [fips](), [hardening](), [software-development](), [software-supply-chain](), [software-supply-chain-attack](), [vulnerability](), [zero-cves]() ### AI overview Chainguard describes its 2025 focus on scaling secure software development through a catalog of more than 1,000 container images, source-built components, daily rebuilding, automation, vulnerability remediation, and hardened images. The company reports patching more than 55,000 CVEs and saving customers over 200,000 engineering hours in 2024. ### Source excerpt Chainguard is building on the success they generated for their customers in 2024. Take a look back at the numbers, and see what's next for us and our users! ## Cybersecurity Venture's 2023 Software Supply Chain Attack Report DevFeed: [Cybersecurity Venture's 2023 Software Supply Chain Attack Report]() Original publisher: [Read original article]() Author: Sydney Milligan Published: 2023-10-10T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [software supply-chain attack](), [supply-chain-security](), [Cybersecurity](), [Critical Infrastructure](), [CI/CD](), [Software as a service]() Tags: [acquisition](), [attacks](), [blog](), [ci-cd](), [cloud](), [critical-infrastructure](), [cybersecurity](), [data-breaches](), [developer](), [infrastructure](), [megawatt](), [phishing](), [report](), [saas](), [secure-software](), [security](), [security-attacks](), [software-supply-chain](), [software-supply-chain-attack](), [software-supply-chain-security](), [supply-chain](), [supply-chain-security](), [vulnerabilities]() ### AI overview The article summarizes findings from Cybersecurity Ventures' 2023 Software Supply Chain Attack Report. It predicts that the global cost of software supply chain attacks could reach nearly $138 billion by 2031 and explains how software complexity, cloud applications, and operational pipelines increase supply chain risk. It describes common attack methods, including social engineering, phishing, stolen credentials, CI/CD pipeline compromise, vulnerability exploitation, open-source component targeting, typosquatting, insider threats, and cloud hijacking. The article also examines the 2020 SolarWinds attack, in which a backdoor inserted into an Orion update affected approximately 18,000 customers and put critical infrastructure operations at risk. ### Source excerpt Cybersecurity Ventures predicts the global cost of software supply chain attacks will reach nearly $138 billion by 2031. Learn more by reading the 2023 Software Supply Chain Attack Report.