Software Supply Chain Security News

Stay up to date with the latest software supply chain security incidents, including malicious packages, dependency attacks, and real-world breaches. We break down what happened, why it matters, and what developers should fix to stay ahead.

Subscribe to our newsletter.
No spam, guaranteed.

Featured

April 30, 2026

Popular PyTorch Lightning Package Compromised by Mini Shai-Hulud

Malware found in popular PyTorch Lightning version 2.6.2 and 2.6.3, stealing credentials, crypto wallets, and VPN configs as part of the Mini Shai-Hulud campaign.

#Malware

April 29, 2026

Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files

A fake "tanstack" npm package published four malicious versions in 27 minutes today, exfiltrating .env files via a postinstall hook. Here's what happened, who was affected, and how to rotate your credentials.

#Malware

April 29, 2026

Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer

Compromised SAP npm packages use a Bun-based preinstall payload to steal GitHub, npm, cloud, and CI secrets, then spread via GitHub using OhNoWhatsGoingOnWithGitHub.

#Malware

#NPM