September 24, 2025
By Rodrigo Luna
NPM Compromises Expose Critical Weakness in the Software Supply Chain
In September 2025, two major NPM compromises exposed the fragility of the software supply chain—from phishing-driven credential theft to the wormable Shai-Hulud attack. This bulletin details how open-source trust was exploited and the risks for defenders.