Between June and mid-July 2026, four supply chain attacks targeted npm and PyPI ecosystems, employing tactics including a Python startup file worm, typosquatted payment SDKs harvesting CI secrets, stolen publishing tokens, and a hijacked CI pipeline. These attacks focused on stealing credentials from developer environments and build pipelines, highlighting vulnerabilities in CI workflows and the limitations of provenance signatures, which cannot guarantee the safety of code even when verifying its origin. Despite recent platform mitigations, these incidents underscore the need for enhanced visibility and secret management across development infrastructure to quickly assess and respond to such compromises.
https://blog.gitguardian.com/shai-hulud-npm-pypi-supply-chain-attacks/