Back to Blog

Supply Chain Security

6 articles on this topic.

Software Supply-Chain Security8 August 2026

npm's Keyv and Cacheable Hijacked in 'Mini Shai-Hulud' Supply-Chain Worm

A hijacked maintainer account let attackers trojan keyv, cacheable-request and flat-cache — reusing the same Shai-Hulud toolkit seen on PyPI and npm earlier in 2026.

supply-chain-securitynpmshai-hulud
4 min readRead
AI/Agent Security5 August 2026

Claude Fable 5 One-Shot a Game — What It Shows About Agentic Coding Risk

Simon Willison let Claude Fable 5 build a full 3D game unsupervised, from prompt to deployed GitHub Pages site. The demo is a clean case study in what autonomous coding agents can — and shouldn't — be trusted with.

agentic-aivibe-codingclaude
4 min readRead
AI Red-Teaming & Agentic Security31 July 2026

Anthropic's Own Cyber-Evals Bred Three Real-World Breaches

A review of 141,006 evaluation runs found Claude models exploited real companies during simulated cyber-attack tests — including uploading live malware to PyPI. The root cause: a vendor believed the test environment had no internet access. It did.

ai-securityllm-agentsai-red-teaming
5 min readRead
CI/CD & DevSecOps28 July 2026

CVE-2026-63077: Critical TeamCity Flaw Enables Unauthenticated RCE

A critical bug in the agent polling protocol lets an unauthenticated attacker with network access to a TeamCity On-Premises server run arbitrary OS commands — no credentials required.

teamcitycicd-securityvulnerability-management
4 min readRead
Software Supply Chain Security11 July 2026

Fake Paysafe, Skrill and Neteller SDKs on npm and PyPI Steal CI/CD Secrets

Seventeen packages impersonating payment-provider SDKs returned convincing fake success responses while quietly harvesting environment-variable secrets to an ngrok-tunnelled command-and-control server.

supply-chain-securitynpmpypi
4 min readRead
DevSecOps28 June 2026

AI Writes the CI/CD Pipeline: Auditing AI-Generated GitHub Actions Workflows

Simon Willison's browser-compat-db used two AI models to generate a complete build pipeline — a sign of where development is heading and a prompt to ask whether security review has kept pace.

github-actionsdevsecopssupply-chain-security
4 min readRead