Security Insights
Deep dives, expert analysis, and practical guidance on exposure management, adversarial validation, and the future of AI-driven exposure management.
The TanStack npm Supply Chain Attack That Hit 170 Packages and Punishes You for Revoking Your Token
The TanStack npm supply chain attack hit 12 million weekly downloads using three public techniques and zero novel code. Here is exactly how it worked.
Axios npm Supply Chain Attack: 83M Weekly Downloads Compromised by Cross-Platform RAT
On March 31, 2026, attackers compromised the axios npm maintainer account and published backdoored versions deploying a cross-platform RAT to macOS, Windows, and Linux. Full incident breakdown with IOCs, detection guidance, and real-time AI-driven response.
How One Phishing Email Compromised 18 npm Packages and Billions of Installs
On September 8, 2025, a single phishing email triggered one of npm’s most damaging supply chain attacks, compromising 18 popular JavaScript packages with over 2.6 billion weekly downloads. By tricking a maintainer into revealing credentials and 2FA codes, attackers injected crypto-stealing malware i