Ongoing story · 1 report

Software Supply-Chain Attacks in 2026

Attackers kept targeting trusted software providers in 2026, slipping malicious code into npm and PyPI releases and into scripts that vendors serve to their customers' sites. This page lists our incident reports in date order, each covering what was affected, how the attack worked, and the checks developers can run.