developer-identity

npm, PyPI and Docker Hub in 2026: developer credentials became supply-chain infrastructure

Credential harvesting against npm, PyPI and Docker Hub has turned developer identity into supply-chain infrastructure, with package registries now functioning as distribution systems for stolen trust.