--- title: "#supply-chain articles | Hashnode" description: "Explore 684 articles tagged #supply-chain on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/supply-chain" --- Tag # #supply-chain 684 posts · 5 followers [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [12h ago](https://hashnode.com/posts/claude-code-extension-cursor-ssh-backdoor-en/6af521707f684f460a365300) ### [A verified publisher name, 11 hours of distribution, and one SSH key that stays behind: the fake Claude Code extension on Cursor Marketplace](https://blog.fiscybersec.com/claude-code-extension-cursor-ssh-backdoor-en?utm_source=hashnode&utm_medium=feed) Summary On October 29, 2026, two versions of the Anthropic.claude-code extension — 2.1.312 and 2.1.313 — appeared on the Cursor VS Code Extension Marketplace with malicious code injected. The distribu 13 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/claude-code-extension-cursor-ssh-backdoor-en?utm_source=hashnode&utm_medium=feed) [Prashant Koirala](https://hashnode.com/@prashantkoirala) · [1d ago](https://hashnode.com/posts/vulnerability-response-is-becoming-a-24-hour-operational-duty/6af34dec82c341bfd30b4c3d) ### [Vulnerability response is becoming a 24-hour operational duty](https://blog.prashantkoirala.info.np/vulnerability-response-is-becoming-a-24-hour-operational-duty?utm_source=hashnode&utm_medium=feed) Since 11 September 2026, the EU Cyber Resilience Act puts exploited vulnerabilities on a 24-hour clock. The hard part is engineering. 34 min read · [blog.prashantkoirala.info.np](https://blog.prashantkoirala.info.np/vulnerability-response-is-becoming-a-24-hour-operational-duty?utm_source=hashnode&utm_medium=feed) [Damiano Bianda](https://hashnode.com/@damianobianda) · [4d ago](https://hashnode.com/posts/no-ransom-note-europe-s-freezer-attacks-and-the-new-sabotage-playbook/6af0489fe85e91eadbf4c8fa) ### [No Ransom Note: Europe's Freezer Attacks and the New Sabotage Playbook](https://damianobianda.hashnode.dev/no-ransom-note-europe-s-freezer-attacks-and-the-new-sabotage-playbook?utm_source=hashnode&utm_medium=feed) On the night of Monday, November 2, supermarket freezers in at least ten European countries quietly stopped being freezers. Remote refrigeration controllers were pushed into maximum-temperature defros 6 min read · [damianobianda.hashnode.dev](https://damianobianda.hashnode.dev/no-ransom-note-europe-s-freezer-attacks-and-the-new-sabotage-playbook?utm_source=hashnode&utm_medium=feed) [Hu Jin](https://hashnode.com/@whoai) · [4d ago](https://hashnode.com/posts/mcp-supply-chain-attacks-poisoned-npm-and-pypi-dependencies-security-1/6af06f1f6bd10e54d9953b99) ### [MCP Supply Chain Attacks: Poisoned npm and PyPI Dependencies (Security 1)](https://whoai.hashnode.dev/mcp-supply-chain-attacks-poisoned-npm-and-pypi-dependencies-security-1?utm_source=hashnode&utm_medium=feed) How a poisoned npm or PyPI package can take over an MCP server, and practical defenses: lockfiles, provenance, allowlists, and runtime egress control. 4 min read · [whoai.hashnode.dev](https://whoai.hashnode.dev/mcp-supply-chain-attacks-poisoned-npm-and-pypi-dependencies-security-1?utm_source=hashnode&utm_medium=feed) [Aayush Rajaji](https://hashnode.com/@aayushrajaji) · [Nov 5](https://hashnode.com/posts/unlocking-trapped-working-capital-how-smart-factories-use-small-language-models-to-cut-inventory-days-by-30/6aec0921454381f8268b1b46) ### [Unlocking Trapped Working Capital: How Smart Factories Use Small Language Models to Cut Inventory Days by 30%](https://aayushrajaji.hashnode.dev/unlocking-trapped-working-capital-how-smart-factories-use-small-language-models-to-cut-inventory-days-by-30?utm_source=hashnode&utm_medium=feed) How Indian factories use on-premise Small Language Models to cut inventory days by 30% and free up crores in trapped working capital. 7 min read · [aayushrajaji.hashnode.dev](https://aayushrajaji.hashnode.dev/unlocking-trapped-working-capital-how-smart-factories-use-small-language-models-to-cut-inventory-days-by-30?utm_source=hashnode&utm_medium=feed) [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Nov 5](https://hashnode.com/posts/litellm-1107-supply-chain-attack-chain-en/6aec002a8fddbd4c58bf3572) ### [One key nobody revoked, four months later a malicious PyPI package](https://blog.fiscybersec.com/litellm-1107-supply-chain-attack-chain-en?utm_source=hashnode&utm_medium=feed) Summary On October 21, 2026, LiteLLM's release pipeline published a malicious litellm==1.107.0 to PyPI, Docker Hub and GHCR. The package was signed and shipped through the official process, so every s 14 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/litellm-1107-supply-chain-attack-chain-en?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Nov 4](https://hashnode.com/posts/cpguard-update-compromise-opsshield-backdoor/6aeb570036fa48e3e9b93df9) ### [cPGuard Update Compromise: The Ban That Never Held](https://404-founders.com/blog/cpguard-update-compromise-opsshield-backdoor?utm_source=hashnode&utm_medium=feed) Two OpsShield notices, one fake update that ran as root on about 2,950 hosting servers 12 min read · [404-founders.com](https://404-founders.com/blog/cpguard-update-compromise-opsshield-backdoor?utm_source=hashnode&utm_medium=feed) [Cyber Knight](https://hashnode.com/@cyberknight2479) · [Nov 4](https://hashnode.com/posts/the-attacker-didn-t-break-into-production-it-walked-in-through-development/6aead83c3ed9f2c028e09a58) ### [The Attacker Didn't Break Into Production. It Walked In Through Development](https://nulltrace.hashnode.dev/the-attacker-didn-t-break-into-production-it-walked-in-through-development?utm_source=hashnode&utm_medium=feed) Chainstack's breach started in a dev environment, reached production five days later, and stayed quiet — until the company said the honest thing about its customers' keys. 4 min read · [nulltrace.hashnode.dev](https://nulltrace.hashnode.dev/the-attacker-didn-t-break-into-production-it-walked-in-through-development?utm_source=hashnode&utm_medium=feed) [Mukul Kumar](https://hashnode.com/@pydevgo) · [Nov 2](https://hashnode.com/posts/slopsquatting-ai-package-hallucinations/6ae81440f4b618f8a8c1a968) ### [A package name from a code model is still an untrusted dependency](https://buildopsy.hashnode.dev/slopsquatting-ai-package-hallucinations?utm_source=hashnode&utm_medium=feed) Are AI-generated code dependencies a real security risk? 2 min read · [buildopsy.hashnode.dev](https://buildopsy.hashnode.dev/slopsquatting-ai-package-hallucinations?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Nov 1](https://hashnode.com/posts/hugging-face-malware-load-mine-trust-remote-code/6ae781ff337edf7e5c740460) ### [Hugging Face Malware: Load/Mine Abused trust\_remote\_code](https://404-founders.com/blog/hugging-face-malware-load-mine-trust-remote-code?utm_source=hashnode&utm_medium=feed) Load/Mine hid a cryptominer and reverse shells in fake Qwen2 models on Hugging Face. How trust\_remote\_code ran it and how to check your GPU hosts. 17 min read · [404-founders.com](https://404-founders.com/blog/hugging-face-malware-load-mine-trust-remote-code?utm_source=hashnode&utm_medium=feed)