Supply-chain-security is a topic tracked in our intelligence system with 5 linked articles.
A sign-in flaw in Anomaly's OpenCode AI coding agent allowed malicious or hijacked MCP servers to execute code with the developer's own privileges on Windows and WSL machines, patched in version 1.18.33 in September.
The FCC under Brendan Carr has used its new supply-chain blocking power for the first time, barring two gadgets from authorization because they contain a HiVision Hi3516CV610 camera SoC deemed a 'foreign surveillance chip' — a precedent that threatens any hardware relying on covered-list Chinese chips.
A credential-stealing npm worm linked to Keyv infected hundreds of packages; SafeDep found 353 poisoned versions across 79 package names, with a wider footprint of 442 versions across 353 names, and Aikido estimates at least 868 affected packages.
Two compromised joyfill npm packages execute a RAT on import, highlighting software supply-chain risk in Node.js ecosystems.
DepsGuard is an active open-source Rust tool that hardens npm/pnpm/yarn/bun/uv configs via an interactive UI with backups and restore, backed by recent updates and a security-focused feature set.
A jqwik 1.10.0 protestware incident embeds stdout commands aimed at coding agents, illustrating a new supply-chain risk vector with regulatory/compliance signals and ecosystem implications.
Subscribe for real-time topic updates and unlimited access to our intelligence platform.