Maintenance in progress

a self-propagating worm called chaindrop compromised more than 1,300 npm software packages with roughly 2 billion monthly downloads, including widely used caching libraries, after a maintainer's github account was taken over. in parallel, inc ransomware is exploiting two fresh sonicwall vulnerabilities across the us, australia, uae, colombia and switzerland, and switzerland's federal it office reported 200 accounts compromised. the same week shows both ends of the supply chain under pressure: the code developers import, and the appliances guarding the perimeter.

threat-intelligence and package-registry advisories