Supply Chain Attacks Are Evolving in 2025: Cases from NPM, PyPI, and CI/CD

Comments (1)

fatidevrel · 7h ago

This write-up by the Xygeni research team details the most advanced software supply chain attacks observed so far in 2025. It breaks down how threat actors are planting backdoors in trusted packages, targeting CI/CD pipelines, and bypassing basic scanners. Covers both npm and PyPI examples, plus tactics like dependency hijacking and poisoning GitHub workflows. Curious how others are defending against these multi-layered attacks.

Show HN: Visual Editor for Cursor (shuffle.dev)

Collabora Advances Rust-for-Linux with New Tyr DRM Driver for Mali GPUs (linuxgizmos.com)

LLM Failures (Joe Marshall) (funcall.blogspot.com)

Founder mode will become the new Manager mode [video] (youtube.com)

Show HN: Git for Normies (github.com)

Computer-Science Bubble Is Bursting (msn.com)

Network-debug – A CLI tool to fix slow Wi-Fi and poor network tuning on Linux (github.com)

Show HN: Mednotegen, medical synthetic note generator (github.com)

AI challenge to find lost Amazonian civilizations draws critics (science.org)

Elon Musk's Grok AI chatbot is posting antisemitic comments (cnbc.com)

WebAssembly: How Low Can a Bytecode Go? (queue.acm.org)

When in Doubt, Go for a Walk (fabiansjournal.bearblog.dev)

Swiss cheese model (en.wikipedia.org)

Renoise 3.5 - Feature Showcase [video] (youtube.com)

Class of Models with Potential to Represent Fundamental Physics (arxiv.org)

3D stacking method created to overcome traditional semiconductor limitations (techxplore.com)

Confidential AI Inference with Attestation: Run LLMs and Agents on Tees (github.com)

Can ChatGPT "see" red? Results of study are nuanced (chan.usc.edu)

Elon Musk's Grok praises Hitler, shares antisemitic tropes in new posts (axios.com)

Alpha-One 7B LLM Agentic/Generative AI Agent (pine64.com)

US Court nullifies FTC requirement for click-to-cancel (arstechnica.com)

Up the kriek: Apple gets punchy in Brussels DMA compliance workshop (brucelawson.co.uk)

US 'click to cancel' rule blocked by appeals court (reuters.com)

Xenharmlib: A music theory library that supports non-western harmonic systems (xenharmlib.readthedocs.io)

Colossal Biosciences to de-extinct giant Moa bird (stuff.co.nz)

Build with Claude (anthropic.com)

A.I. slop and the epidemic of Bad writing [video] (youtube.com)

Amarok 3.3 "Far Above the Clouds" released (blogs.kde.org)

"Watershed moment:" Big battery storage prices hit record low in China auction (reneweconomy.com.au)

China Wants to Use 115,000 Banned Nvidia Chips to Fulfil Its AI Ambitions (bloomberg.com)

Bayeux Tapestry to be loaned to the UK for first time (independent.co.uk)

Why Do Some Language Models Fake Alignment While Others Don't? (arxiv.org)

Inflation expectations drift back down to pre-tariff levels, Fed survey shows (cnbc.com)

Show HN: Did that MCP Server leak your database? (github.com)

Agency (henrikkarlsson.xyz)

FakeFind

Why small-time criminals burned a London warehouse for Russia's Wagner Group (bbc.co.uk)

Ask HN: Any tool that can auto instrument code and serve as a debugging copilot

Google's Approach for Secure AI Agents (research.google)

Design Patterns for Securing LLM Agents Against Prompt Injections (arxiv.org)

Ask HN: Who here uses a productivity system daily?

Stop Training Your Competitor's AI (cacm.acm.org)

Global PeaceTech Hub, where tech meets governance (globalpeacetech.org)

Our dev team tried replacing typing with talking and it's working (deepgram.com)

How do airplane toilets work? (popsci.com)

Show HN: Gtime – A colorful CLI tool to compare and convert time zones (github.com)

Welcome to Your Job Interview. Your Interviewer Is A.I (nytimes.com)

Huston Plan (en.wikipedia.org)

A deal that protected the Amazon from soy farming starts to show cracks (japantimes.co.jp)

Even old brains can make new neurons, study suggests (popsci.com)

Supply Chain Attacks Are Evolving in 2025: Cases from NPM, PyPI, and CI/CD

Comments (1)