The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches | Qualys

Summary: Qualys documents a consistent kill chain across supply chain attacks from September 2025 to May 2026: install-time code on developer machines or CI runners harvests cloud credentials, which are then used to reach cloud resources. The May 19, 2026 Mini Shai-Hulud wave compromised 639 package versions across 323 packages in the @antv ecosystem, including echarts-for-react with 1.1 million weekly downloads, targeting GITHUB_TOKEN, AWS keys, KUBECONFIG, and VAULT_TOKEN via the preinstall hook.
What you should know: The malware runs before application controls engage, so removing the package is not containment - the first question is what cloud access the exposed credentials could authorize, and actors like TeamPCP and ShinyHunters pair that theft with data extortion.

Read the original at Qualys Blog ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026