Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Shai-Hulud worm recently compromised more than 500 NPM packages, including the popular @ctrl/tinycolor, which alone receives over two million weekly downloads. This marks the first self-propagating supply chain attack in the NPM ecosystem, with the malware harvesting cloud credentials, backdooring GitHub Actions, and spreading automatically to other maintainer packages. While this incident is unprecedented in its automation, supply chain attacks are not new.

In the race to secure today’s ever-expanding attack surface, many companies have made a practice of using a mix of tools to monitor, assess, and remediate threats. This practice has resulted in a fragmented and chaotic landscape of security solutions across several teams, increasing complexity and forcing companies to have a reactive vs. proactive security posture.

From customer-facing applications to internal systems, your businesses run on code. As CISOs, you may know that this reliance comes with a growing, complex challenge: securing the Software Development Lifecycle (SDLC) from end to end, especially against the insidious threat of software supply chain attacks.

Originally published: April 2023 Updated: September 2025 Supply chain attacks are a growing and increasingly sophisticated form of cyber threat. They target the complex network of relationships between organizations and their suppliers, vendors, and third-party service providers. These attacks exploit vulnerabilities that emerge due to the interconnected nature of digital supply chains, which often span multiple organizations, systems, and geographies.

OWASP AppSecDays France 2025 explored supply chain trust, CI/CD as the new perimeter and passkeys, showing how shared guardrails make secure delivery possible.