Topic
SUPPLY CHAIN
All blog posts, tools, and guides about Supply Chain from Developers Digest.
7 resources - 7 posts
Blog Posts
View in blog →
Ray CVE-2025-62593: Botnet Beat the Patch, CISA Gives Feds 3 Days
The RondoDox botnet started exploiting Ray CVE-2025-62593 two days before the CVE was public, and CISA gave federal agencies just three days to remediate. Here is how to check whether your Ray cluster or dev machine is exposed and what to harden first.
7 min read
arrayref 0.3.10 Ran a Remote Payload at Build Time
On August 20, 2026, compromised arrayref 0.3.10 pulled in a proc-macro1 typosquat whose build script fetched a remote binary. Coding agents that cargo update on yank warnings walk into this.
8 min read
GitHub Malware Advisories Now Cover Eight Package Ecosystems
Dependabot's malware detection expands from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer by ingesting OpenSSF's malicious-packages data into the GitHub Advisory Database.
6 min read
A Security Camera Shipped a GitHub Admin Token in Its Login Page
A security researcher found a GitHub personal access token with admin privileges to hundreds of repos baked into Hanwha Vision camera firmware. The cause: a Vite build leaking process.env into production.
6 min read
Perplexity Bumblebee: Developer Guide to the Open Source Supply Chain Scanner
Bumblebee is Perplexity's open source scanner for detecting compromised packages, extensions, and MCP configs on developer machines. A read-only Go binary that checks npm, PyPI, Go modules, and 10+ ecosystems against exposure catalogs - without running any install scripts. Here is how to set it up and use it.
7 min read
Mastra npm Supply Chain Attack: 140+ AI Framework Packages Backdoored
On June 17, 2026, attackers hijacked a dormant Mastra contributor account and pushed malicious versions of 140+ packages. The payload steals crypto wallets, browser data, and cloud credentials. Here is what happened, how to check your lockfile, and what to do if you installed an affected version.
7 min read
TanStack's npm Compromise Is the CI Lesson Agent Teams Needed
The TanStack npm incident was not just a package-security story. It was a reminder that AI agent workflows inherit every weak trust boundary in CI.
9 min read
Keep exploring
More on Supply Chain
- - Compare Tools - dive deeper across the Developers Digest knowledge base
- - All Supply Chain articles in the blog archive
- - Developers Digest on YouTube - video tutorials covering Supply Chain and more
Get Smarter About AI Dev
New tutorials, open-source projects, and deep dives on coding agents - delivered weekly.
One email per weekReal code, not theoryFree forever
Explore 908 topics
Browse All Topics