Category
Open-source, CI/CD and dependency attacks, and how to stop them.
The software supply chain is under relentless attack from campaigns like TeamPCP and the Axios hack. Learn actionable, step-by-step strategies to secure your CI/CD pipelines and developer endpoints.
A massive supply chain attack has hit the popular npm package Axios. Versions 1.14.1 and 0.30.4 deploy a stealthy Remote Access Trojan (RAT) via a fake dependency. Learn how to detect and remediate this critical threat.
TeamPCP strikes again. The popular Python package litellm (versions 1.82.7 and 1.82.8) was compromised on PyPI, deploying a credential harvester and Kubernetes backdoor.
Aqua Security's Trivy was compromised a second time on March 19, 2026, by "TeamPCP." Learn how malicious v0.69.4 and GitHub Actions were used to steal CI/CD secrets, how to detect the breach, and immediate remediation steps.
Anatomy of the mass NPM hijack that breached the internet's core. This CISO's guide details the attack, its impact, and the immediate action plan you must execute now.
CISA new tool translates security needs into ironclad contract language, solving the biggest problem in software supply chain security. A CISO guide to secure procurement.
Unlock software supply chain security with SBOMs. Explore what an SBOM is, why it's vital for vulnerability management & compliance, current challenges, and future outlook.
Looking for something specific?
Search every article by topic, tool or CVE.