3 pieces in Third-Party & Supply Chain Risk.
In a few weeks, attackers poisoned a security scanner, an AI gateway library and one of the most-used HTTP clients in JavaScript. The common thread was where those tools run, and what credentials sit beside them.
September brought two major npm compromises in a week, one of them a worm that used stolen tokens to publish itself into hundreds of packages. An analysis of how it spread, and the controls that break the chain.
The largest theft in cryptocurrency history didn’t break the exchange’s cold-wallet controls. It changed what the signers saw. The lessons apply to any organization that approves high-value actions through a vendor’s interface.