Developer Workstations Are Now Part of the Software Supply Chain

<p>Bitwarden serves over 10 million users and 50,000 businesses. On April 22, 2026, for exactly 93 minutes, its CLI was shipping malware.</p> <p>This was not a phishing campaign.

Cybersecurity researchers have discovered a fresh software supply chain attack campaign that has compromised various npm packages associated with the @antv ecosystem as part of

<p>Three incidents landed in five days this week. Different attack surfaces, different techniques, different threat actors. What they have in common is that none of them required

<p>In May 2026, a worm called Shai-Hulud compromised 42 TanStack packages — including <code>@tanstack/react-router</code>, a library sitting in millions of JavaScript projects. It

Cybersecurity researchers have flagged a new class of CI/CD workflow weakness that allows attackers to hijack workflows and compromise open-source supply chains. The "critical

A new supply chain attack targeting the Node Package Manager (npm) ecosystem is stealing developer credentials and attempting to spread through packages published from compromised