The Package Registry Layer: How Supply-Chain Attacks Are Targeting Agent Infrastructure

The LiteLLM Breach and the New Reality of AI Infrastructure On March 24, 2026, the Python Package Index (PyPI) hosted malicious versions of the LiteLLM library—specifically 1.82.7 and 1.82.8—for ...
CPO Magazine

Self-Propagating Malware ChainDrop Hits Over 400 NPM Packages in Massive Supply Chain Attack

A massive supply chain attack on the Node Package Manager (npm) registry has infected over 400 packages with over 2 billion downloads with the self-propagating malware ChainDrop, a new variant of the ...
cybersecuritynews

New Shai-Hulud Supply Chain Attack Compromised 400+ Popular npm Packages

A new npm supply chain attack has turned trusted software packages into a route for credential theft. The campaign began after attackers compromised the maintainer account behind the widely used Keyv ...
Bleeping Computer

Massive ChainDrop npm supply-chain attack infects hundreds of packages

Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry. Infected packages include ...
cybersecuritynews

North Korean Hackers Turn Trusted npm Packages Into a Gateway for Supply-Chain Attacks

The campaigns affected the typo-crypto, debug, chalk, and axios packages at different points between March 2025 and March 2026. Organizations that automatically installed the newest versions could ...
Bleeping Computer

GitHub, PyPI add time-based defenses against supply chain attacks

GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact.