Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
OSV published 2,128 MAL malicious-package reports from 1 Sep to 16 Oct 2026. npm had 1,299 and RubyGems 677, and one afternoon produced 611 RubyGems entries.
On 3 June 2026 a worm hit 57 npm packages without a single preinstall or postinstall script. It runs through binding.gyp and node-gyp instead. Here is how to find it.
On 1 June 2026 a compromised employee GitHub account pushed orphan commits that added a release workflow, then published 32 malicious npm releases with valid provenance.
On 17 June 2026 an attacker added a lookalike of dayjs as a dependency across 140+ @mastra packages. The dropper was blocked in one test by an egress rule.
From 24 June 2026 a hijacked maintainer account published malicious Leo Platform and RStreams packages that run through binding.gyp. Sonatype counts 23 versions.
A caching bug let one account's RubyGems API key be served to another caller for up to an hour. On 23 July 2026 all legacy keys were revoked. What to check on your gems.
From 17 August 2026 new NuGet.org API keys last at most 30 days, and every older key stops working on 1 November 2026. Publishers should move to trusted publishing.
On 4 August 2026 the ChainDrop worm published keyv 6.0.0 and dozens of other packages through a real release workflow. The provenance was genuine, and the package was still malicious.
Bloom Security found 677 VS Code Marketplace packs and 94 Open VSX packs that reference extensions that no longer exist. Claim the name and the pack installs your code.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
