Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This week, our hosts dive into the evolving threat of software supply chain attacks and the growing risks facing the open-source ecosystem. As developers increasingly rely on third-party packages and AI-powered coding tools, attackers are finding new ways to abuse trusted software to reach a wider range of targets. The discussion explores why these attacks are becoming more common, what recent incidents reveal about the state of software security, and what organizations can do to better protect themselves.

Sources: ⁠

Shai-Hulud worm returns stronger and more automated than ever before ⁠

‘Mini Shai-Hulud’ malware compromises hundreds of open-source packages in sprawling supply-chain attack ⁠

What We Learned: Axios NPM Supply Chain Compromise Emergency Briefing

Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise