By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

The Cloud-Native Digest is a monthly roundup on all things cloud native, artifact management, and supply chain security from Cloudsmith's Head of Developer Relations, Nigel Douglas.

Last month, we saw an unprecedented spike in software supply chain attacks across a variety of different open source software upstreams - such as 73 OpenVSX extensions linked to GlassWorm, TeamPCP attacks on SAP CAP npm packages, compromised TanStack npm packages, Intercom npm packages, PyTorch Lightning PyPI packages, as well as super high-profile malicious Checkmarx artifacts and a compromise of the Bitwarden CLI. There were too many supply chain attacks to count, in all honesty, so in this month’s change-up we’ve decided to provide a list of the most impactful supply chain incidents in chronological order (as well as the usual news roundup).

If you’re seeing a lot of malicious packages with a “

” ID, similar to that of vulnerabilities with “

” - but don’t know how to track these malicious software packages, check out my recent 

Sicoob.Sdk - NuGET package steals banking credentials

Researchers have discovered a malicious NuGet package named 

k that masquerades as a legitimate C# library for Brazil’s Sicoob banking system, stealing sensitive business client IDs and PFX authentication certificates to enable API integration impersonation and financial abuse. This package, which was inadvertently amplified by Google Search AI Mode, hid its data-stealing code in the distributed registry while keeping its linked GitHub repository clean. At the same time, a surge in broader software supply chain attacks has been reported, including 14 malicious npm packages published by a single actor to harvest AWS and CI/CD secrets, alongside hundreds of other npm components exploiting dependency confusion and manufactured legitimacy tactics to compromise developer workflows.

https://thehackernews.com/2026/05/malicious-sicoob-nuget-steals-banking.html

In a coordinated effort, CrowdStrike, Google, and the Shadowserver Foundation have simultaneously dismantled all C2 channels associated with GlassWorm, a highly resilient, likely Russia-based cybercrime campaign. Since early 2025, the group has targeted software developers by planting data-stealing malware, including JavaScript RATs inside malicious VS Code extensions, npm packages, and Python packages, ultimately poisoning over 300 GitHub repositories. To evade takedowns, GlassWorm utilised complex indirection layers across the Solana blockchain, BitTorrent DHT, Google Calendar, and commercial VPS infrastructure, highlighting the massive blast radius and persistent threat facing modern software supply chains.

https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html

Cybersecurity researchers have discovered a malicious npm package (

 designed to steal data from the directory used by Anthropic’s Claude AI tool. Masquerading as a legitimate deployment utility, the malware uses a GitHub access token during its postinstall stage to recursively upload victim files to a threat actor-controlled repository while hiding behind fake logs. Interestingly, the package leaked its own private GitHub token, suggesting the threat actor may have used AI to generate the malware without maintaining basic OPSEC, a trend that researchers expect to rise as AI lowers the barrier to entry for creating malware.

https://thehackernews.com/2026/05/malicious-npm-package-stole-files-from.html

Throughout the month of May, a single npm account (

) published 141 packages containing an identical payload: a web proxy unblocker built on the 

 framework. Disguised as tutoring websites, these packages function as adware, monetised via popunder ads and tracking scripts rather than relying on traditional install hooks or credential stealers. This campaign represents a case of npm registry abuse, essentially leveraging the registry as free, disposable CDN infrastructure for adware distribution.

https://safedep.io/malicious-npm-terminal3airport-proxy-adware-spam

Published under a new maintainer account (

 RAT campaign immediately after the original was removed. Spanning 22 versions (

) between May 4th and 26th the updated malware introduced advanced capabilities, including crypto-wallet scanning with BIP39 validation, browser extension database theft across over 21 browsers, WebRTC data channels, durable persistence, and auto-upgrades. Exfiltrated data continues to route to the original C2 server and attacker-controlled Hugging Face repositories.

https://cyberpress.org/malicious-npm-rat-backdoor

34 malicious packages across 384 versions were used to steal crypto wallets, SSH keys, cloud credentials, and developer secrets from crypto, DeFi, Solana, and AI environments. The malware abused npm hooks, Python imports, and Rust build scripts for execution and persistence.

https://phoenix.security/trapdoor-supply-chain-ai-poisoning-npm-pypi-crates

A coordinated supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux binary retrieved from a GitHub Release URL. This cross-ecosystem placement makes the activity stand out because developers and security teams scanning PHP dependencies may only focus on Composer-related metadata, while skipping package.json lifecycle hooks that are bundled within the package.

https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html

A coordinated supply chain attack involved the rapid publication of 9 malicious npm packages by a throwaway account (

) designed to impersonate legitimate Polymarket trading tools and AI coding assistants. Upon installation, a postinstall script detects if it is running in an interactive terminal to evade automated CI/CD security detection. In interactive sessions, the malware harvests any 

 files without interaction and social engineers users into pasting their private keys via a fake, encrypted onboarding prompt. In reality, the unencrypted, plaintext Ethereum/Polygon private keys are immediately exfiltrated to an attacker-controlled Cloudflare Worker endpoint, while a persistent local directory (

) is created to fingerprint and track the victim's device across sessions.

https://safedep.io/malicious-polymarket-npm-crypto-wallet-drainer

Nigel Douglas

Head of Developer Relations

Cloud Native Digest

Cloud Native Digest - May 2026

June has been an exciting month for software devs. We’ve witnessed mind-boggling consolidation in the AI space (SpaceX buying Cursor for a casual $60B?!), major security overhauls coming to 

, with sadly more of the same AI-fuelled supply chain worms like 

As malicious payloads get faster and smarter, the industry is fighting back with coordinated, ecosystem-wide infrastructure defences like the 

 coalitions. The line between writing code and defending it has officially vanished. Shared tooling like 

 are helping devs address the security burdens introduced by AI.

You’ll want to grab a coffee, there’s a lot to unpack in this month’s newsletter.

Enjoying the updates? See where your own defences stand with our Free Artifact Security Maturity Assessment at the bottom of this edition!

Safer pull request target defaults for GitHub Actions checkout
Date: 

 (starting with v7 and backporting to existing major versions on July 16th) to automatically block insecure checkout patterns from fork pull requests during highly privileged 

 events. This change directly addresses dangerous pwn request vulns where unreviewed code from forks could otherwise execute with full access to your repository's secrets and tokens. While same-repo PRs are unaffected and an explicit 

 escape hatch exists for workflows that genuinely require this behaviour, devs are still urged to review their workflows as pinned floating tags will automatically inherit this strict security enforcement.

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout

Inside the Mastra npm supply chain attack
Date:

The popular Mastra AI development framework was attacked by leveraging a former contributor's hijacked 

 credentials to inject a malicious dependency (

) across 144 ecosystem packages. The attackers used a typosquatted clone and an obfuscated 

 script to deploy a highly evasive, self-deleting payload that bypassed traditional detection and exploited unenforced 

https://cloudsmith.com/blog/inside-the-mastra-npm-supply-chain-attack

Shai-Hulud copycat campaign targets Python devs
Date:

The security researchers at GitLab discovered a malicious PyPI supply chain campaign by the account 

 that deployed the open-source Shai-Hulud worm against Python developers. The attack used 4 typosquatted packages impersonating popular libraries (

) alongside a weaponised legitimate project, 

, executing a stealthy, obfuscated JavaScript payload automatically at install time via Python's 

 file mechanism. Once active, the self-propagating worm harvests credentials across all major cloud providers and CI/CD platforms, while automatically injecting malicious files into accessible repositories and publishing poisoned updates to expand its reach.

https://about.gitlab.com/blog/shai-hulud-copycat-campaign-targets-python-developers

The Miasma worm's path of destruction
Date:

This self-replicating malware strain rooted in the TeamPCP threat group, has triggered a massive open-source supply chain disaster by infiltrating Red Hat's 

 namespace and compromising 73 Microsoft GitHub repositories (including core 

 tools). By hijacking legitimate dev credentials to acquire OIDC tokens and valid SLSA provenance attestations, the worm routinely bypassed conventional security scanners and used uniquely encrypted payloads to evade hash-based detection. Designed to weaponise popular AI coding tools like Claude Code, Miasma automatically executed when infected repos were opened, specifically targeting dev endpoints and CI/CD runners to scrape high-value cloud identities and registry credentials.

https://cloudsmith.com/blog/miasma-worms-path-of-destruction

Blocking malware for every Composer version inside Packagist
Source:

To address PHP security gaps where devs or CI systems have used older Composer versions (like, pre-2.10) or have manually disabled malware policies, we are now seeing Private Packagist introduce repo-level malware blocking. By integrating directly with the Aikido’s continuous malware feed, Private Packagist now automatically refuses to serve dist/artifact files for flagged packages, now returning an HTTP 410 error to any client regardless of its Composer version.

The quiet shift reshaping PHP security
Source:

In 2026, PHP security is shifting from a fragmented, reactive approach to a highly coordinated, ecosystem-wide responsibility. Driven by AI initiatives like Project Glasswing and the newly formed 

, vulnerabilities are being identified and patched faster than ever. Infra-level risks and supply chain threats are being aggressively countered by centralised security updates in tools like Composer and Packagist, which now enforce MFA and block known vulnerable packages by default. However, a significant gap remains for dev teams.

One Month of Ecosystem Security Engineering
Source:

One month after receiving an Alpha-Omega grant, and the establishing the PHP Foundation's new Ecosystem Security Team (mentioned earlier), the foundation is now using a collaborative, AI-powered security scanner called 

 to scan open-source repositories, find vulnerabilities, verify, draft a fix, and even publish the advisory. The initiative has already scanned over 300 major PHP packages and frameworks, leading to nearly a hundred public security fixes. Backed by highly positive community feedback and a growing team of volunteers, the project intends to scan another 250 projects next month while shifting focus toward deeper analyses of core PHP and its extensions.


VibePHP: A PHP engine that runs on vibes, not code
Source:

VibePHP is a satirical, next-gen PHP runtime and web server built on Laravel and AI that completely replaces standard interpreters and compilers with LLM inference. When an HTTP request comes in, the AI reads the PHP source code, executes it "in its head". It then completely hallucinates plausible HTTP responses, databases, and missing functions on the fly, making non-existent syntax like generics and inline Go/Rust magically "just work". While it introduces a massive 7-second latency and costs a staggering $0.0063 per request, it totally justifies this by boosting perceived value by 700,000%.

Upcoming breaking changes for npm v12
Source:

The upcoming, July 2026 npm release will introduce stricter security-related default behaviours for 

 by making previously automatic actions opt-in. Specifically, it will block dependency installation scripts by default (

 turns off), restrict git dependency resolution (

) unless explicitly allowed by the user. Devs can prepare for this upgrade now by using 

run npm approve-scripts --allow-scripts-pending

 to audit package scripts, and commit the approved allowlist directly to your 


FastAPI can now serve your frontend app
Source:

FastAPI version 0.138.0 now has support for client-side routing. This is especially useful for frontend tools that generate static files, like React with Vite, TanStack Router, Astro, Vue, Svelte, Angular, Solid, and others. Instead of building the frontend and generating a directory like - 

 that includes all of your frontend files, you can now instead use 

 to serve that directory following the conventions needed by the frontend frameworks.


Messenger - free browser game built using WebGL and Three.js
Source:

Messenger is a free-to-play browser game crafted by developers 

, it delivers a rich 3D experience directly in the browser without requiring heavy game engines like Unity or any client-side downloads. By combining asset pipelines from Houdini and Blender with a custom live multiplayer framework, the devs allowed players to seamlessly explore the globe together and interact via dynamic 3D emojis.


Malicious npm packages are deploying Windows RAT malware
Source:

Researchers discovered a malicious typosquatting campaign on npm where three packages (

) masquerading as legitimate dev tools to deliver a full-featured Windows Remote Access Trojan (RAT). When installed, the JS dropper triggers a PowerShell script that downloads a ZIP archive containing a Python-based payload. The RAT can steal Chrome creds, gather host info, and execute shell commands via a dedicated C2 server.

rtk - Rust CLI cuts coding agent token usage by 60-90%
Source:

Want to slash your coding agent's token bills by up to 90%? RTK makes it happen by acting as a smart filter between your terminal and your LLM. Instead of dumping hundreds of lines of Git logs, test results, or Docker outputs into the context window, it strips out the noise and passes along only the critical data. Built as a single, memory-safe Rust binary with zero dependencies, it operates with a barely noticeable 10ms overhead. Don't worry about missing context either. If a command fails, the full output is saved locally for your agent to grab later.


Launching the Rust Foundation Maintainers Fund
Source:

The Rust Project and the Rust Foundation have launched the Rust Foundation Maintainers Fund alongside a new Funding team to secure stable, long-term financial support for the project's maintainers. A core initiative of this fund is the Maintainer in Residence program, which will hire maintainers (typically near full-time) to focus on critical areas like the compiler, standard library, and Cargo. This centralised fund, which is open to both individual and corporate donations via GitHub Sponsors aims to combat the recent industry budget shifts that have caused key contributors to lose funding, ensuring the long-term health and development of Rust as its industry adoption grows.



Launching the Rust Commercial Network (RCN)
Source:

RCN is a free, collaborative initiative launched by the Rust Foundation to connect teams using Rust in production with the language's core developers. By hosting monthly meetings under the Chatham House Rule and maintaining public 

 chat channels, the network aims to bridge the gap between industrial users and maintainers, allowing companies to share best practices, solve common challenges, and drive corporate funding. Managed by a dedicated steering committee and backed by numerous founding orgs, the RCN focuses on accelerating widespread adoption, supporting small to mid-sized businesses, and securing the long-term sustainability of the Rust ecosystem.


The author thanks the community for supporting stdx, an extended standard library for 

, and addresses why the project is distributed exclusively via Git rather than crates.io. He argues that centralised package registries are fundamentally flawed and insecure, introducing critical supply chain vulnerabilities like name-squatting, credential theft, and hidden backdoors. The author advocates for a secure-by-design architecture modelled after 

, where package managers pull code directly from signed Git repositories rather than relying on a centralised middleman. Ultimately, by bypassing 

, the author hopes to spark a shift in the Rust ecosystem toward simpler, more secure dependency distribution.


Rust backdoor turns prompt injection on the analyst, not the sandbox
Source:

, a DPRK-aligned Rust implant. It gaslights the AI reading the output. Embedded inside a tiny prompt-injection payload binary, 38 fabricated 

 messages are built to steer an LLM-assisted triage pipeline into aborting or refusing its analysis. Fake token expiries, out-of-memory kills, disk exhaustion, and bogus injection warnings. Originally 

 backdoor spoofs the triage harness's own prompt scaffold, which blurs the security boundaries.

’s 3rd beta version is the third of four planned preview releases designed for community testing and project preparation ahead of the official release candidate phase in August. While not recommended for production environments, this feature-complete preview introduces significant upgrades, including explicit lazy imports for faster startup, a new 

 built-in type, UTF-8 as the default encoding, and an upgraded JIT compiler boasting substantial performance improvements on both Linux and macOS.

Pywho is a great tool for explaining your Python environment
Source:

 tool is a zero-dependency, cross-platform CLI & Python API designed to instantly diagnose Python environment configs and import issues. It eliminates the "

" debugging bottleneck we’re all so familiar with. By generating a comprehensive report of the active interpreter, virtual environment, and 

, its primary benefit is the import tracing where it details exactly how and where a module is loaded. It also offers shadow scanning, which audits projects for local files that accidentally override standard library or third-party packages.

Hunting Leaked PyPI Tokens: 62 Live, 125 Packages Exposed
Source:

GitGuardian discovered 62 valid PyPI tokens leaking publicly on GitHub and Docker Hub, exposing 

 to potential supply chain attacks. By decoding the macaroon API token restrictions and safely verifying their validity via broken API requests, the researchers bypassed expected automated GitHub scanning protections to find these active vulnerabilities. Following a responsible disclosure, the PyPI security team successfully revoked all 62 tokens and implemented new admin tooling to streamline future disclosures, highlighting the critical need for developers to scan for secrets, use project-scoped tokens, and properly configure 

Python flaw allowed attackers to forge Admin-Level API requests
Source:

A critical authentication bypass flaw (that has since been 

 release management API went undetected for over a decade. It allowed attackers to impersonate admins by pairing a valid username with an arbitrary API key. If exploited, attackers could have altered official download and signature verification URLs to orchestrate massive global supply chain attacks, though they could not directly modify the source binaries. The Python Security Response Team (PSRT) quickly patched the vulnerability within 48 hours of its disclosure, and subsequent forensic audits confirmed 

Understanding the transition from K8s Dashboard to Headlamp
Source

Following the archiving of the Kubernetes Dashboard, Headlamp has emerged as its modern successor. Headlamp preserves some of the familiar visual workflows, resource views, and even RBAC-compliant editing. However, it expands on those capabilities beyond the traditional, single-cluster view. Headlamp introduces multi-cluster management, application-centric 

, and extensibility through community or custom plugins (such as GitOps and AI assistants). Headlamp offers flexible deployment options as both an in-cluster tool and as a desktop app.

Kubernetes finally has User Namespace support
Source

’s general availability of user namespace support (

) successfully mitigates certain container escapes by remapping root users to unprivileged host UIDs, it fails to solve the critical shared kernel problem. In fact, granting namespaced capabilities actually increases the reachable host kernel attack surface by 

. This exposes vulnerable subsystems like 

 to unprivileged containers. As AI-assisted tools rapidly accelerate the discovery of exploitable kernel bugs that entirely bypass namespace protections, Kaylin argues that true multi-tenant isolation cannot be achieved at the UID layer.

Introducing Minimus Community Edition
Source:

Minimus just opened its entire catalogue of secure container images to everyone, for free! The new Community Edition gives any developer hundreds of continuously built-from-source, near-zero CVE images, with no registration, auth wall, or procurement. FIPS, CIS, NIST SP 800-190, and STIG compliance come built in. These are the same images Minimus customers already run in production across finance, government, and healthcare.

Open source maintainership in the age of AI
Source:

The rapid rise of AI-assisted coding has made generating code much faster, but it has also strained the maintenance of open-source projects. To address this, the Kubernetes community has introduced an AI policy that embraces these tools while enforcing strict human accountability. Kubernetes requires transparency, human-only engagement, and thorough manual verification. Additionally, the project is actively experimenting with automated AI review tools like GitHub Copilot and CodeRabbit to act as quality gates and reduce maintainer burnout, marking a mature step toward balancing technological innovation with human oversight.

SpaceX Buys Cursor In Largest Startup Acquisition Ever At $60 Billion
Source

In an all-stock deal valued at $60 billion, SpaceX has acquired Anysphere, the parent company of the AI coding tool Cursor, marking the largest venture-backed startup acquisition in history. Expected to close in the third quarter of 2026 following SpaceX’s recent $75 billion IPO, the deal integrates Cursor's advanced capabilities and vast developer user base with Elon Musk's xAI and Grok model.

Cursor quietly acquires Continue, an open-source alternative to Copilot
Source:

In a quiet consolidation move, Cursor had acquired Continue, a popular open-source alternative to GitHub Copilot with over 34,000 GitHub stars. Following Cursor's recent acquisition by SpaceX, this deal came as a shock to users. Continue's proprietary services are winding down, and users have until July 15th to export their data. However, the founding team pushed a final 2.0.0 update removing telemetry and handed the codebase over to the community, allowing the open-source project to remain publicly available for future development under its 

Fake AI agent skill passed all scans and reached 26,000 agents
Source:

To demonstrate critical flaws in AI agent security, security firm AIR successfully deployed a deceptive AI skill that bypassed multiple security scanners, inherited 36,000 GitHub stars via a repository merge, and reached roughly 26,000 agents (including corporate accounts) through targeted Instagram ads. The skill slipped past scanners by initially linking to legitimate documentation on an external domain controlled by AIR, only to swap the destination for a data-collecting payload after passing review.

Nvidia “open-sourced one of the most important AI projects right now”
Source:

 on Github, a security scanner designed to protect users from malicious or vulnerable AI Skills. These executable code packages that agents will run to perform specific automated tasks are scannable for security blind spots. Since these imported skills run with the same system access as the user, they pose severe security risks like credential harvesting, data leaks, and prompt injection, with research showing 1 in 4 public skills contain vulnerabilities.

Cloudsmith Blog

Cloud Native Digest - May 2026

Cloud Native Digest - June 2026