Desk · Software supply chain

Supply Chain

Coverage of dependency compromise, build systems, package ecosystems, and vendor risk.

Articles: 3
Topics: 2

Data graphic: a timeline of 23 September 2026 UTC headlined "MemTensor's own CI shipped a worm". After an attacker branch was pushed and deleted five times between 00:48 and 02:03, malicious npm releases 0.1.21 02:23 , 0.1.23 03:49 and 0.1.25 04:36 alternate with clean 0.1.22 03:45 and 0.1.24 04:33 , issue #173 opens at 04:17, and PyPI MemoryOS 2.0.34 follows at 05:25: four poisoned releases, all carrying the sckit worm. Pin 0.1.20 and 2.0.33.

MemTensor's OpenClaw Plugin and MemoryOS Shipped the sckit Credential Worm

Pushed commits made MemTensor's own GitHub Actions jobs leak npm and PyPI tokens. Four releases then shipped sckit, a Go worm that steals developer secrets.

Oct 2 · 8 min

ThreatFrontier poster showing Trivy CVE-2026-33634 supply chain compromise in CI/CD pipelines

highSupply Chain Supply Chain

Trivy Vulnerability Turns Trusted CI/CD Scanner Into Supply Chain Secret-Stealing Threat

CVE-2026-33634 turned trusted Trivy releases and GitHub Actions into credential-stealing malware inside CI/CD pipelines and developer environments.

May 18 · 5 min

Mini Shai-Hulud supply chain worm trusted publishing abuse diagram

criticalSupply Chain Supply Chain

Mini Shai-Hulud Worm Exposes Limits of Trusted Publishing After 170+ npm and PyPI Packages Hit

The Mini Shai-Hulud campaign compromised more than 170 reported npm and PyPI packages, exposing how trusted publishing and provenance can still be abused when CI/CD environments are compromised.

May 15 · 5 min