Request Demo
Mastra Supply Chain Attack: How Do CI/CD Pipelines Survive Malicious Dependencies? 

Mastra Supply Chain Attack: How Do CI/CD Pipelines Survive Malicious Dependencies? 

Mastra Supply Chain Attack: How Do CI/CD Pipelines Survive Malicious Dependencies?  TL;TR  The recent Mastra Supply Chain Attack exposed a critical vulnerability in modern software development. Threat actors compromised over 144 packages within the Mastra npm ecosystem by injecting a malicious dependency called easy-day-js. This dependency utilized npm postinstall scripts to silently download remote access payloads during the standard build process. Because these actions occur

Model Fork-Bombing: The Impending Collapse of Open-Source Trust 

Model Fork-Bombing: The Impending Collapse of Open-Source Trust 

Model Fork-Bombing: The Impending Collapse of Open-Source Trust  TL;DR  Between March 19 and March 31, 2026, five major open-source projects serving hundreds of millions of installations were compromised. Trivy, Checkmarx, LiteLLM, Telnyx, and Axios all fell within twelve days. If your enterprise uses these tools, and most do, you faced credential theft from five independent

The Shadow Dependency Trap: Why Your Software Is a Trojan Horse 

The Shadow Dependency Trap: Why Your Software Is a Trojan Horse 

The Shadow Dependency Supply Chain Risk: When Your Software Becomes the Threat TL;DR  Modern software depends on external libraries, many of which are invisible. This creates Shadow Dependency Supply Chain Risk, where attackers exploit hidden dependencies to enter systems silently. Traditional security tools often miss these threats because they appear as trusted updates, not vulnerabilities.  Introduction 

The 72-Hour Blitz: How TeamPCP Weaponized GitHub to Steal Enterprise Credentials

The 72-Hour Blitz: How TeamPCP Weaponized GitHub to Steal Enterprise Credentials

The 72-Hour Blitz: How TeamPCP Weaponized GitHub to Steal Enterprise Credentials TL;TR  Between late 2024 and early 2025, a threat actor known as TeamPCP executed a high-velocity “blitz” on the GitHub ecosystem. By creating hundreds of malicious repositories that mimicked high-trust DevOps tools like Trivy, Checkmarx, and LiteLLM, they successfully tricked developers into executing credential-stealing malware. The attack utilized automated infrastructure to saturate search