DevSecOps

Cybersecurity 7 min Miasma Returns With 'Phantom Gyp': npm Worm Sidesteps the Install-Script Defences Teams Just Deployed On 3 June, two days after the Red Hat npm compromise, the Miasma worm returned with a new delivery trick: a 15... CY Cyber Team 11 Jun Developer Tools 7 min Miasma: How a Hijacked CI Pipeline Shipped Malicious npm Packages With Valid Provenance The Miasma supply-chain attack didn't typosquat or steal an npm token — it hijacked a maintainer's CI pipeline... KE Kenji Tanaka 8 Jun Cybersecurity 12 min Megalodon Campaign Backdoors 5,561 GitHub Repos in Six Hours — Inside a Mass GitHub Actions Supply-Chain Attack An automated campaign called Megalodon pushed 5,718 malicious commits to 5,561 GitHub repos on 18 May 2026, ex... CY Cyber Team 23 May Cybersecurity 6 min Sonatype Counts 454,600 New Malicious Packages in 2025 — And AI Coding Agents Widen the Risk Sonatype identified more than 454,600 new malicious open-source packages in 2025. Here is what developers need... CY Cyber Team 5 May