Why Software Supply Chain Security Is Moving to the Gate

T2Covered by 1 source · first reported by DevOps.com / Cloud Native Now at 24 Sept, 15:38 UTC

March 2026: malicious versions of axios get published directly to npm. May 2026: attackers forge valid provenance for 42 TanStack packages on npm, with 84 malicious versions shipped before detection. August 2026: a worm uses one maintainer’s stolen credentials to self-propagate through keyv and its…