SUPPLY CHAIN

The RondoDox botnet started exploiting Ray CVE-2025-62593 two days before the CVE was public, and CISA gave federal agencies just three days to remediate. Here is how to check whether your Ray cluster or dev machine is exposed and what to harden first.

On August 20, 2026, compromised arrayref 0.3.10 pulled in a proc-macro1 typosquat whose build script fetched a remote binary. Coding agents that cargo update on yank warnings walk into this.

Dependabot's malware detection expands from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer by ingesting OpenSSF's malicious-packages data into the GitHub Advisory Database.

A security researcher found a GitHub personal access token with admin privileges to hundreds of repos baked into Hanwha Vision camera firmware. The cause: a Vite build leaking process.env into production.

Bumblebee is Perplexity's open source scanner for detecting compromised packages, extensions, and MCP configs on developer machines. A read-only Go binary that checks npm, PyPI, Go modules, and 10+ ecosystems against exposure catalogs - without running any install scripts. Here is how to set it up and use it.

On June 17, 2026, attackers hijacked a dormant Mastra contributor account and pushed malicious versions of 140+ packages. The payload steals crypto wallets, browser data, and cloud credentials. Here is what happened, how to check your lockfile, and what to do if you installed an affected version.

The TanStack npm incident was not just a package-security story. It was a reminder that AI agent workflows inherit every weak trust boundary in CI.