Researchers report an ongoing npm supply-chain campaign using the malicious indexed-btree package, which activates when an application uses it, bypassing npm’s default blocking of dependency install scripts.
Ridge tested eight LLMs across 96 autonomous penetration-testing runs and found results depended heavily on the agent harness and context. Coverage varied, costs differed sharply, and some models refused authorized test steps.
A retrospective examines S1ngularity, Shai-Hulud and TeamPCP supply-chain attacks, detailing how stolen credentials and malicious package updates spread malware, steal secrets and compromise downstream projects.