Software Supply Chain Security11 July 2026
Fake Paysafe, Skrill and Neteller SDKs on npm and PyPI Steal CI/CD Secrets
Seventeen packages impersonating payment-provider SDKs returned convincing fake success responses while quietly harvesting environment-variable secrets to an ngrok-tunnelled command-and-control server.
supply-chain-securitynpmpypi
4 min readRead
AI Security28 June 2026
Prompt Injection in the Wild: npm Malware Weaponises AI Content Filters to Evade Analysis
A malicious npm package published in June 2026 combines prompt injection, bio-weapons safety-trigger text, and context-flooding to blind AI-assisted dependency scanners — revealing a new evasion frontier in which the security toolchain itself becomes the attack surface.
prompt injectionsupply chainnpm
5 min readRead