Supply Chain Security

One click. Full access to every private repository your developer can reach. Researcher Ammar Askar published a working exploit for a VS Code zero-day on June 2 — after going through Microsoft’s disclosure process and losing confidence in the response timeline. He dropped it publicly. Microsoft patched within 24 hours. The target: GitHub’s browser-based editor,…

The security tool your developer just installed may have already stolen your cloud keys. Red Hat’s official npm namespace was compromised on June 1. Thirty-two packages under @redhat-cloud-services — collectively downloaded ~80,000 times per week — contained a preinstall script that ran before a single line of application code executed. By the time the package…