01
29 July 2026 · 14 min read
Joyfill npm packages ran a RAT when imported
Two Joyfill prereleases contained a RAT loaded on module import. We explain the blockchain C2 resolver, exposure evidence and response plan.
Topic · 11 articles
Supply Chain Security
Risk across dependencies, packages, suppliers and CI/CD, with practical ways to verify provenance, integrity and the organisational impact of change.
FIELD NOTES
TOPIC INDEX
Latest research
02
11 July 2026 · 15 min read
SBOM explained: CycloneDX, SPDX and VEX in practice
Learn what an SBOM is, how CycloneDX and SPDX differ, where VEX fits, which minimum elements matter and how to build a trustworthy CI/CD process.
03
10 July 2026 · 9 min read
Patch the Planet: AI finds bugs in critical open source
AI found hundreds of potential flaws across major open-source projects, but triage, reproduction, safe patches and maintainer review remain essential.
04
1 July 2026 · 11 min read
Sigstore and SLSA: Proving Where Software Artifacts Come From
Signing without key management (Sigstore) and verifiable build provenance (SLSA) are the new supply chain defense. We translate Fulcio, Rekor, cosign and SLSA levels.
05
11 June 2026 · 7 min read
Software supply chain attacks, explained
A single dependency can compromise thousands of companies at once. We explain how supply chain attacks work and how to limit dependency risk.
06
25 May 2026 · 12 min read
Third-party risk management (TPRM): a guide
Your security ends at your weakest supplier. How to assess contractor risk, what to put in contracts and how to monitor suppliers efficiently.
07
16 May 2026 · 17 min read
AI Models Without Malware: Pickle vs SafeTensors
Pickle, SafeTensors, ONNX, and AI checkpoints explained: prevent code execution and build a controlled, verifiable model supply-chain pipeline.
08
14 May 2026 · 10 min read
Mini Shai-Hulud: an npm and PyPI worm (2026)
In May 2026 the Mini Shai-Hulud worm hit npm and PyPI at once, stealing CI/CD secrets. We analyse the attack and how to harden your pipeline.
09
7 April 2026 · 18 min read
TeamPCP: how Trivy, KICS, LiteLLM and axios broke CI/CD trust
Technical analysis of the March 2026 supply-chain wave: hijacked Trivy and KICS tags, LiteLLM .pth execution, axios, CI/CD secrets and recovery.
10
16 September 2025 · 10 min read
Shai-Hulud: the first self-replicating npm worm
In autumn 2025 the Shai-Hulud worm infected hundreds of npm packages, spreading itself. We analyse the supply chain attack and how to secure your pipeline.
11
26 August 2025 · 10 min read
OAuth token theft: one vendor, hundreds of firms
In 2025, stolen OAuth tokens from Salesloft exposed hundreds of firms' Salesforce data — with no cracked passwords. A lesson on integration risk.
BR / NEXT STEP
Want to prepare your team for these threats?
We turn current threats into role-based training, safe exercises and a clear reporting path. The free Academy remains available for self-directed learning.
NDA · clear scope · direct communication