#slsa
2 cases
keyv npm Compromise: A Credential-Stealing Worm That Shipped With Valid ProvenanceSupply Chain AttackMalware
The malicious release carried valid SLSA provenance and passed every integrity check, because the honest build pipeline compiled source that was already poisoned. It also ran when a developer merely opened the folder.
Supply Chain AttackMalware
ChainDrop and the Shai-Hulud Lineage: Anatomy of a Self-Propagating npm Supply Chain WormMalwareSupply Chain Attack
Between late 2025 and mid-2026, the software supply chain threat landscape underwent a fundamental paradigm shift with the emergence of the Shai-Hulud malware lineage. Culminating in the highly...
MalwareSupply Chain Attack