←All topics

pypi

2 pieces of writing

security13 min read

May 2026 developer-tooling compromises: VS Code extensions, PyPI packages and GitHub Actions turned workstations into supply-chain targets

May 2026 supply-chain compromises showed that poisoned developer tooling now targets the identity and execution layer before code reaches a repository.

security12 min read

npm, PyPI and Docker Hub in 2026: developer credentials became supply-chain infrastructure