'Black October': A dozen supply chain attacks hit npm, PyPI, Docker and infra in days
burny_tech · x · 2026-10-22
Security community is calling the recent wave of supply chain compromises 'Black October', with a dozen incidents listed in one thread:
- Poisoned packages: TensorLake npm package infected, LiteLLM shipped malicious PyPI + Docker releases, backdoored npm package in SubQuery
- Infra breaches: Zeabur infrastructure breached, OVHcloud CLI official binaries backdoored, Railway customer secrets exposed, ConnectWise cloud backup identities compromised
- AI tooling hit: OpenCode exposed AI API keys, GhostAction malicious GitHub workflows (tied to broader Shai-Hulud/ChainDrop activity)
- Higher stakes: eMudhra certificate authority keys compromised (downstream impact on Tailscale), malware inside the official RankMath PRO plugin
Author's takeaway: 'some complete madness — 1/3 of the internet is fucked.'
More from Safety
- Banks brace for AI worst-case scenarios as rapid AI progress becomes a security nightmare — kimmonismus · 2026-10-22
- Your unpublished ideas in chatbots could leak—experts on how to reduce the risk — _akpiper · 2026-10-22
- AI cyber offense vs defense is just the same old arms race, says security pro — ziv_ravid · 2026-10-22
- Open models will be the central pillar of AI cyber defense, argues security thread on PHP bugs — ziv_ravid · 2026-10-22
- Axios scoop: US banks detect unauthorized AI agents inside customer accounts — daniel_mac8 · 2026-10-22
- Phil Koopman's Keynote: Agentic AI Trust Is Won or Lost at the Edge Cases — DavidLinthicum · 2026-10-22