AINewsnow

Supply-chain attacks: package cooldowns and policy checks for npm, PyPI and NuGet

This story is from 2026-08-28. It is preserved in the archive; the latest stories are on the live feed.

On 4 August 2026, a self-propagating worm called ChainDrop tore through npm. BleepingComputer reported more than 1,300 compromised packages with about two billion monthly downloads between them, including keyv, cacheable, flat-cache and file-entry-cache. The poisoned releases carried a "preinstall"…

Read the full story at DEV Community — AI ↗

Timeline · 1 report

  1. 2026-08-28 00:50 · DEV Community — AI
    Supply-chain attacks: package cooldowns and policy checks for npm, PyPI and NuGet

More stories

  1. Gemini Hacked Three Companies in First Known Breakout by Google’s AI — Wall Street Journal Technology
  2. Introducing Kimi K3 on Amazon Bedrock — AWS Machine Learning Blog
  3. Introducing Amazon SageMaker HyperPod Inference Gateway — AWS Machine Learning Blog
  4. Anthropic, OpenAI, SpaceXAI, Google sued over call to ‘pace’ AI development — Politico Technology
  5. NVIDIA CEO Jensen Huang rejects ‘AI will end the world’ claim, yet cautions ‘we should go as fast as we can but...’ — Mint AI
  6. AI hallucination of Chinese nuclear components almost led to US military attack — Ars Technica AI
  7. The new AgentCore runtime: Elastic, optimized, and consistently fast starts — AWS Machine Learning Blog
  8. Qwen Image 2.1 PR to ComfyUI — r/StableDiffusion

Get the daily brief of stories like this at 6:30 every morning →