Supply-Chain - 1

2026 (5)

August (2)

security: ChainDrop supply chain compromise: Anatomy of a self-propagating worm

Microsoft Security Blog

2026-08-04

Microsoft describes ChainDrop, a credential-stealing worm embedded in 400+ compromised npm packages that spread by republishing malicious updates across software ecosystems. The post outlines the attack chain, affected environments, and guidance for detection, hunting, and remediation.

dotnet: Strengthening NuGet Supply Chain Security: Reducing API Key Lifetime

.NET

2026-08-03

NuGet API key lifetimes will be reduced to 30 days starting August 17, with the goal of improving supply chain security.

July (3)

github: npm publish-time malware scanning and dual-use metadata

GitHub

2026-07-28

npm is adding automatic malware scanning when packages are published, along with a new metadata requirement for packages that may be used for both benign and malicious purposes. The changelog says this is part of ongoing supply-chain security work and explains what publishers should expect.

github: GitHub Actions holds potentially malicious workflows for approval

GitHub

2026-07-28

GitHub Actions now detects potentially malicious workflow changes in public repositories and requires approval before they run. The change is intended to reduce supply-chain abuse from compromised credentials used to add workflows that steal CI/CD secrets or perform follow-on attacks.

security: Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Microsoft Security Blog

2026-07-16

Microsoft reports that attackers compromised AsyncAPI npm packages and used trusted CI/CD workflows to distribute malware via npm. The writeup details the attack chain, import-time payload delivery, and suggested defenses.