Multi-Wave npm Supply Chain Attacks — IronWorm and Phantom Gyp
··1678 words·8 mins
A deep analysis of the coordinated multi-wave npm supply chain attacks (IronWorm, Phantom Gyp, Miasma, Shai-Hulud) that exposed thousands of developers and
- Osmond van Hemert — Senior Software Engineer & Applied AI/
- Blog Categories: AI, Security, Development & Infrastructure/
- Security Incidents, Vulnerabilities & Defense/
Security Incidents, Vulnerabilities & Defense
This category gathers posts where security is the main story: breaches, vulnerabilities, software supply-chain incidents, and the practical response to each. Use the articles below to examine how attacks work, what is known, and which defensive decisions follow from the evidence.
For incident timelines, visit Breaches & Zero Days. The Cybersecurity tag follows security themes across other categories too, including infrastructure and developer tooling.
The Proof-of-Concept That Became Real — AI Worms Are Here
··2360 words·12 mins
Researchers at the University of Toronto have demonstrated a working proof-of-concept: an AI worm that autonomously reasons about its environment, generates
Anthropic's AI Framework Automates Vulnerability Discovery
··1742 words·9 mins
Anthropic released an open-source framework for automated vulnerability discovery powered by AI.
TanStack NPM Supply Chain Compromise — A Postmortem
··2143 words·11 mins
A massive npm supply chain attack compromised TanStack, Mistral AI’s client library, and over 170 packages.
Supply Chain Malware in PyTorch Lightning — AI's Attack Surface
··1190 words·6 mins
A Dune-themed malware campaign targeting the PyTorch Lightning library highlights how AI/ML supply chains are becoming prime targets for sophisticated attacks.
The xz Utils Aftermath — One Year Later, What Have We Fixed?
··1213 words·6 mins
Nearly two years after the xz Utils backdoor shocked the open source world, the supply chain security landscape has changed — but not enough.
Software Supply Chain Security Gets Serious — SLSA and SBOM Rise
··1231 words·6 mins
Supply chain security frameworks like SLSA and SBOM requirements are moving from recommendations to mandates.
Post-Quantum Cryptography — The Migration Clock Is Ticking
··861 words·5 mins
NIST’s post-quantum cryptography standards are finalized, and the migration timeline is no longer theoretical — it’s operational.
Ultralytics Supply Chain Attack — Dependencies Bite Back
··969 words·5 mins
A supply chain attack on the popular Ultralytics YOLO package highlights the persistent vulnerability of the Python ecosystem’s distribution pipeline.
The Zero-Day Treadmill — Why Patch Tuesday Still Matters in 2025
··888 words·5 mins
November’s Patch Tuesday brought critical zero-days being actively exploited, reminding us that patch management is still the unglamorous foundation of
Secure by Design — CISA's Push Is Finally Gaining Real Traction
··865 words·5 mins
CISA’s Secure by Design initiative is moving from voluntary pledges to measurable industry impact, and software vendors are starting to feel the pressure.
EU ChatControl Is Back — And It's Still a Terrible Idea
··1074 words·6 mins
The EU’s latest push to scan encrypted messages reignites the fundamental debate about whether governments can mandate backdoors without destroying security