3 pieces by Ines Carvalho.
In a few weeks, attackers poisoned a security scanner, an AI gateway library and one of the most-used HTTP clients in JavaScript. The common thread was where those tools run, and what credentials sit beside them.
A maximum-severity flaw in React Server Components was exploited within hours of disclosure. The patch was straightforward. Finding every affected application across cloud accounts, hosting platforms and vendor products was not.
September brought two major npm compromises in a week, one of them a worm that used stolen tokens to publish itself into hundreds of packages. An analysis of how it spread, and the controls that break the chain.