By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

The Cloud-Native Digest is a monthly roundup on all things cloud native, artifact management, and supply chain security from Cloudsmith's Head of Developer Relations, Nigel Douglas.



Last month, we saw an unprecedented spike in software supply chain attacks across a variety of different open source software upstreams - such as 73 OpenVSX extensions linked to GlassWorm, TeamPCP attacks on SAP CAP npm packages, compromised TanStack npm packages, Intercom npm packages, PyTorch Lightning PyPI packages, as well as super high-profile malicious Checkmarx artifacts and a compromise of the Bitwarden CLI. There were too many supply chain attacks to count, in all honesty, so in this month’s change-up we’ve decided to provide a list of the most impactful supply chain incidents in chronological order (as well as the usual news roundup).

If you’re seeing a lot of malicious packages with a “

” ID, similar to that of vulnerabilities with “

” - but don’t know how to track these malicious software packages, check out my recent 

Sicoob.Sdk - NuGET package steals banking credentials

 28th May

Researchers have discovered a malicious NuGet package named 

k that masquerades as a legitimate C# library for Brazil’s Sicoob banking system, stealing sensitive business client IDs and PFX authentication certificates to enable API integration impersonation and financial abuse. This package, which was inadvertently amplified by Google Search AI Mode, hid its data-stealing code in the distributed registry while keeping its linked GitHub repository clean. At the same time, a surge in broader software supply chain attacks has been reported, including 14 malicious npm packages published by a single actor to harvest AWS and CI/CD secrets, alongside hundreds of other npm components exploiting dependency confusion and manufactured legitimacy tactics to compromise developer workflows.



https://thehackernews.com/2026/05/malicious-sicoob-nuget-steals-banking.html

 27th May

In a coordinated effort, CrowdStrike, Google, and the Shadowserver Foundation have simultaneously dismantled all C2 channels associated with GlassWorm, a highly resilient, likely Russia-based cybercrime campaign. Since early 2025, the group has targeted software developers by planting data-stealing malware, including JavaScript RATs inside malicious VS Code extensions, npm packages, and Python packages, ultimately poisoning over 300 GitHub repositories. To evade takedowns, GlassWorm utilised complex indirection layers across the Solana blockchain, BitTorrent DHT, Google Calendar, and commercial VPS infrastructure, highlighting the massive blast radius and persistent threat facing modern software supply chains.



https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html

 27th May

Cybersecurity researchers have discovered a malicious npm package (

 designed to steal data from the directory used by Anthropic’s Claude AI tool. Masquerading as a legitimate deployment utility, the malware uses a GitHub access token during its postinstall stage to recursively upload victim files to a threat actor-controlled repository while hiding behind fake logs. Interestingly, the package leaked its own private GitHub token, suggesting the threat actor may have used AI to generate the malware without maintaining basic OPSEC, a trend that researchers expect to rise as AI lowers the barrier to entry for creating malware.



https://thehackernews.com/2026/05/malicious-npm-package-stole-files-from.html

 27th May

Throughout the month of May, a single npm account (

) published 141 packages containing an identical payload: a web proxy unblocker built on the 

 framework. Disguised as tutoring websites, these packages function as adware, monetised via popunder ads and tracking scripts rather than relying on traditional install hooks or credential stealers. This campaign represents a case of npm registry abuse, essentially leveraging the registry as free, disposable CDN infrastructure for adware distribution.



https://safedep.io/malicious-npm-terminal3airport-proxy-adware-spam

 27th May

Published under a new maintainer account (

 RAT campaign immediately after the original was removed. Spanning 22 versions (

) between May 4th and 26th the updated malware introduced advanced capabilities, including crypto-wallet scanning with BIP39 validation, browser extension database theft across over 21 browsers, WebRTC data channels, durable persistence, and auto-upgrades. Exfiltrated data continues to route to the original C2 server and attacker-controlled Hugging Face repositories.



https://cyberpress.org/malicious-npm-rat-backdoor

 24th May

34 malicious packages across 384 versions were used to steal crypto wallets, SSH keys, cloud credentials, and developer secrets from crypto, DeFi, Solana, and AI environments. The malware abused npm hooks, Python imports, and Rust build scripts for execution and persistence.

https://phoenix.security/trapdoor-supply-chain-ai-poisoning-npm-pypi-crates

 23rd May

A coordinated supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux binary retrieved from a GitHub Release URL. This cross-ecosystem placement makes the activity stand out because developers and security teams scanning PHP dependencies may only focus on Composer-related metadata, while skipping package.json lifecycle hooks that are bundled within the package.

https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html

 21st May

A coordinated supply chain attack involved the rapid publication of 9 malicious npm packages by a throwaway account (

) designed to impersonate legitimate Polymarket trading tools and AI coding assistants. Upon installation, a 

 script detects if it is running in an interactive terminal to evade automated CI/CD security detection. In interactive sessions, the malware harvests any 

 files without interaction and social engineers users into pasting their private keys via a fake, encrypted onboarding prompt. In reality, the unencrypted, plaintext Ethereum/Polygon private keys are immediately exfiltrated to an attacker-controlled Cloudflare Worker endpoint, while a persistent local directory (

) is created to fingerprint and track the victim's device across sessions.

https://safedep.io/malicious-polymarket-npm-crypto-wallet-drainer

 20th May

Github shared added details regarding their investigation into unauthorised access to GitHub's internal repositories.

On May 19th, Github detected and contained a compromise of an employee device involving a poisoned VS Code extension. They removed the malicious extension version, isolated the endpoint, and began incident response work immediately.



https://x.com/github/status/2056949168208552080

https://opensourcemalware.com/vscode/nrwl.angular-console

 19th May

A compromised maintainer account led to various npm packages associated with the 

 ecosystem being injected with malware as part of the ongoing Mini Shai-Hulud attacks. This incident affects packages tied to the npm maintainer account 

, a widely used React wrapper for Apache 

 with roughly 1.1 million weekly downloads.

https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft

 published to the Visual Studio Marketplace. The single-actor supply-chain compromise led to the brief publication of a malicious version of the Nx Console VSCode extension (

) to the Visual Studio Marketplace and Open VSX registry. The incident stemmed from an upstream TanStack supply-chain breach seven days prior, which silently exfiltrated a core Nx contributor's GitHub CLI OAuth token and allowed the attacker to bypass unhardened pipeline controls. The extension contained a credential-stealing and persistence payload targeting developer environments; consequently, any users with auto-update enabled during the 39-minute exposure window had to immediately rotate all credentials.



https://nx.dev/blog/nx-console-v18-95-0-postmortem

 18th May

Endor Labs discovered three trojanised versions (

, the official Python SDK for Microsoft's Azure Durable Functions. The malicious code executes silently upon import on Linux systems, deploying a payload designed to steal credentials across major cloud and secrets platforms like AWS, Azure, GCP, and 1Password. Additionally, the malware targets systems located in Israel with a payload that attempts to wipe the filesystem. The affected versions have since been yanked from 

 All three PyPI packages are tracked under 

https://www.endorlabs.com/learn/trojanized-microsoft-sdk-durabletask-1-4-1-through-1-4-3-deliver-credential-stealing-malware

 17th May

An automated supply chain attack codenamed 

 used throwaway accounts and forged CI identities to push 5,718 malicious commits to 5,561 GitHub repositories within a six-hour window. By leveraging compromised credentials, the attackers injected malicious GitHub Actions workflows via a mass-scale variant (

) triggered by pushes/PRs, and a targeted variant (

) that hid behind manual API backdoors. Once executed on CI/CD runners, the payloads scraped and exfiltrated cloud credentials (AWS, GCP, Azure), SSH keys, environment variables, and source code secrets to a central C2 server. High-profile targets included Wiznet and Tiledesk, the latter of which unknowingly propagated the backdoor to the npm registry via routine package updates published directly from its compromised repository.



https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows

 15th May

Two employee devices at OpenAI were recently affected by the high-profile TanStack supply chain attack orchestrated by the cybercrime group TeamPCP, resulting in the limited exfiltration of internal source code credentials. While no user data or production systems were breached, the inclusion of compromised code-signing certificates forced OpenAI to rotate them, requiring macOS ChatGPT Desktop users to update their apps. This incident reflects a broader, ongoing campaign by TeamPCP, which has also impacted Mistral AI and numerous open-source packages. The attacks utilised resilient, multi-tiered malware designed to harvest widespread credentials and cloud infrastructure secrets.



https://thehackernews.com/2026/05/tanstack-supply-chain-attack-hits-two.html

 15th May

Malicious activity in newly published versions of 

, a long-running npm package previously associated with one of the most widely discussed supply chain incidents in the JavaScript ecosystem.

The affected versions confirmed as malicious were:

 All three npm packages are tracked under 

https://snyk.io/blog/malicious-node-ipc-versions-published-npm

Nigel Douglas

Head of Developer Relations

Cloud Native Digest

Cloud Native Digest - May 2026

The Cloud-Native Digest is a monthly roundup on all things cloud native, artifact management, and supply chain security from Cloudsmith's Head of Developer Relations, Nigel Douglas.

June has been an exciting month for software devs. We’ve witnessed mind-boggling consolidation in the AI space (SpaceX buying Cursor for a casual $60B?!), major security overhauls coming to 

, with sadly more of the same AI-fuelled supply chain worms like 

As malicious payloads get faster and smarter, the industry is fighting back with coordinated, ecosystem-wide infrastructure defences like the 

 coalitions. The line between writing code and defending it has officially vanished. Shared tooling like 

 are helping devs address the security burdens introduced by AI.

You’ll want to grab a coffee, there’s a lot to unpack in this month’s newsletter.

Enjoying the updates? See where your own defences stand with our Free Artifact Security Maturity Assessment at the bottom of this edition!

Safer pull request target defaults for GitHub Actions checkout
Date: 

 (starting with v7 and backporting to existing major versions on July 16th) to automatically block insecure checkout patterns from fork pull requests during highly privileged 

 events. This change directly addresses dangerous pwn request vulns where unreviewed code from forks could otherwise execute with full access to your repository's secrets and tokens. While same-repo PRs are unaffected and an explicit 

 escape hatch exists for workflows that genuinely require this behaviour, devs are still urged to review their workflows as pinned floating tags will automatically inherit this strict security enforcement.

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout




Inside the Mastra npm supply chain attack
Date:

The popular Mastra AI development framework was attacked by leveraging a former contributor's hijacked 

 credentials to inject a malicious dependency (

) across 144 ecosystem packages. The attackers used a typosquatted clone and an obfuscated 

 script to deploy a highly evasive, self-deleting payload that bypassed traditional detection and exploited unenforced 

https://cloudsmith.com/blog/inside-the-mastra-npm-supply-chain-attack




Shai-Hulud copycat campaign targets Python devs
Date:

The security researchers at GitLab discovered a malicious PyPI supply chain campaign by the account 

 that deployed the open-source Shai-Hulud worm against Python developers. The attack used 4 typosquatted packages impersonating popular libraries (

) alongside a weaponised legitimate project, 

, executing a stealthy, obfuscated JavaScript payload automatically at install time via Python's 

 file mechanism. Once active, the self-propagating worm harvests credentials across all major cloud providers and CI/CD platforms, while automatically injecting malicious files into accessible repositories and publishing poisoned updates to expand its reach.

https://about.gitlab.com/blog/shai-hulud-copycat-campaign-targets-python-developers




The Miasma worm's path of destruction
Date:

This self-replicating malware strain rooted in the TeamPCP threat group, has triggered a massive open-source supply chain disaster by infiltrating Red Hat's 

 namespace and compromising 73 Microsoft GitHub repositories (including core 

 tools). By hijacking legitimate dev credentials to acquire OIDC tokens and valid SLSA provenance attestations, the worm routinely bypassed conventional security scanners and used uniquely encrypted payloads to evade hash-based detection. Designed to weaponise popular AI coding tools like Claude Code, Miasma automatically executed when infected repos were opened, specifically targeting dev endpoints and CI/CD runners to scrape high-value cloud identities and registry credentials.

https://cloudsmith.com/blog/miasma-worms-path-of-destruction

Blocking malware for every Composer version inside Packagist
Source:

To address PHP security gaps where devs or CI systems have used older Composer versions (like, pre-2.10) or have manually disabled malware policies, we are now seeing Private Packagist introduce repo-level malware blocking. By integrating directly with the Aikido’s continuous malware feed, Private Packagist now automatically refuses to serve dist/artifact files for flagged packages, now returning an HTTP 410 error to any client regardless of its Composer version.



The quiet shift reshaping PHP security
Source:

In 2026, PHP security is shifting from a fragmented, reactive approach to a highly coordinated, ecosystem-wide responsibility. Driven by AI initiatives like Project Glasswing and the newly formed 

, vulnerabilities are being identified and patched faster than ever. Infra-level risks and supply chain threats are being aggressively countered by centralised security updates in tools like Composer and Packagist, which now enforce MFA and block known vulnerable packages by default. However, a significant gap remains for dev teams.



One Month of Ecosystem Security Engineering
Source:

One month after receiving an Alpha-Omega grant, and the establishing the PHP Foundation's new Ecosystem Security Team (mentioned earlier), the foundation is now using a collaborative, AI-powered security scanner called 

 to scan open-source repositories, find vulnerabilities, verify, draft a fix, and even publish the advisory. The initiative has already scanned over 300 major PHP packages and frameworks, leading to nearly a hundred public security fixes. Backed by highly positive community feedback and a growing team of volunteers, the project intends to scan another 250 projects next month while shifting focus toward deeper analyses of core PHP and its extensions.



VibePHP: A PHP engine that runs on vibes, not code
Source:

VibePHP is a satirical, next-gen PHP runtime and web server built on Laravel and AI that completely replaces standard interpreters and compilers with LLM inference. When an HTTP request comes in, the AI reads the PHP source code, executes it "in its head". It then completely hallucinates plausible HTTP responses, databases, and missing functions on the fly, making non-existent syntax like generics and inline Go/Rust magically "just work". While it introduces a massive 7-second latency and costs a staggering $0.0063 per request, it totally justifies this by boosting perceived value by 700,000%.

Upcoming breaking changes for npm v12
Source:

The upcoming, July 2026 npm release will introduce stricter security-related default behaviours for 

 by making previously automatic actions opt-in. Specifically, it will block dependency installation scripts by default (

 turns off), restrict git dependency resolution (

) unless explicitly allowed by the user. Devs can prepare for this upgrade now by using 

run npm approve-scripts --allow-scripts-pending

 to audit package scripts, and commit the approved allowlist directly to your 

FastAPI can now serve your frontend app
Source:

FastAPI version 0.138.0 now has support for client-side routing. This is especially useful for frontend tools that generate static files, like React with Vite, TanStack Router, Astro, Vue, Svelte, Angular, Solid, and others. Instead of building the frontend and generating a directory like - 

 that includes all of your frontend files, you can now instead use 

 to serve that directory following the conventions needed by the frontend frameworks.



Messenger - free browser game built using WebGL and Three.js
Source:

Messenger is a free-to-play browser game crafted by developers 

, it delivers a rich 3D experience directly in the browser without requiring heavy game engines like Unity or any client-side downloads. By combining asset pipelines from Houdini and Blender with a custom live multiplayer framework, the devs allowed players to seamlessly explore the globe together and interact via dynamic 3D emojis.



Malicious npm packages are deploying Windows RAT malware
Source:

Researchers discovered a malicious typosquatting campaign on npm where three packages (

) masquerading as legitimate dev tools to deliver a full-featured Windows Remote Access Trojan (RAT). When installed, the JS dropper triggers a PowerShell script that downloads a ZIP archive containing a Python-based payload. The RAT can steal Chrome creds, gather host info, and execute shell commands via a dedicated C2 server.

rtk - Rust CLI cuts coding agent token usage by 60-90%
Source:

Want to slash your coding agent's token bills by up to 90%? RTK makes it happen by acting as a smart filter between your terminal and your LLM. Instead of dumping hundreds of lines of Git logs, test results, or Docker outputs into the context window, it strips out the noise and passes along only the critical data. Built as a single, memory-safe Rust binary with zero dependencies, it operates with a barely noticeable 10ms overhead. Don't worry about missing context either. If a command fails, the full output is saved locally for your agent to grab later.



Launching the Rust Foundation Maintainers Fund
Source:

The Rust Project and the Rust Foundation have launched the Rust Foundation Maintainers Fund alongside a new Funding team to secure stable, long-term financial support for the project's maintainers. A core initiative of this fund is the Maintainer in Residence program, which will hire maintainers (typically near full-time) to focus on critical areas like the compiler, standard library, and Cargo. This centralised fund, which is open to both individual and corporate donations via GitHub Sponsors aims to combat the recent industry budget shifts that have caused key contributors to lose funding, ensuring the long-term health and development of Rust as its industry adoption grows.



Launching the Rust Commercial Network (RCN)
Source:

RCN is a free, collaborative initiative launched by the Rust Foundation to connect teams using Rust in production with the language's core developers. By hosting monthly meetings under the Chatham House Rule and maintaining public 

 chat channels, the network aims to bridge the gap between industrial users and maintainers, allowing companies to share best practices, solve common challenges, and drive corporate funding. Managed by a dedicated steering committee and backed by numerous founding orgs, the RCN focuses on accelerating widespread adoption, supporting small to mid-sized businesses, and securing the long-term sustainability of the Rust ecosystem.



The author thanks the community for supporting stdx, an extended standard library for 

, and addresses why the project is distributed exclusively via Git rather than crates.io. He argues that centralised package registries are fundamentally flawed and insecure, introducing critical supply chain vulnerabilities like name-squatting, credential theft, and hidden backdoors. The author advocates for a secure-by-design architecture modelled after 

, where package managers pull code directly from signed Git repositories rather than relying on a centralised middleman. Ultimately, by bypassing 

, the author hopes to spark a shift in the Rust ecosystem toward simpler, more secure dependency distribution.



Rust backdoor turns prompt injection on the analyst, not the sandbox
Source:

, a DPRK-aligned Rust implant. It gaslights the AI reading the output. Embedded inside a tiny prompt-injection payload binary, 38 fabricated 

 messages are built to steer an LLM-assisted triage pipeline into aborting or refusing its analysis. Fake token expiries, out-of-memory kills, disk exhaustion, and bogus injection warnings. Originally 

 backdoor spoofs the triage harness's own prompt scaffold, which blurs the security boundaries.

’s 3rd beta version is the third of four planned preview releases designed for community testing and project preparation ahead of the official release candidate phase in August. While not recommended for production environments, this feature-complete preview introduces significant upgrades, including explicit lazy imports for faster startup, a new 

 built-in type, UTF-8 as the default encoding, and an upgraded JIT compiler boasting substantial performance improvements on both Linux and macOS.



Pywho is a great tool for explaining your Python environment
Source:

 tool is a zero-dependency, cross-platform CLI & Python API designed to instantly diagnose Python environment configs and import issues. It eliminates the "

" debugging bottleneck we’re all so familiar with. By generating a comprehensive report of the active interpreter, virtual environment, and 

, its primary benefit is the import tracing where it details exactly how and where a module is loaded. It also offers shadow scanning, which audits projects for local files that accidentally override standard library or third-party packages.



Hunting Leaked PyPI Tokens: 62 Live, 125 Packages Exposed
Source:

GitGuardian discovered 62 valid PyPI tokens leaking publicly on GitHub and Docker Hub, exposing 

 to potential supply chain attacks. By decoding the macaroon API token restrictions and safely verifying their validity via broken API requests, the researchers bypassed expected automated GitHub scanning protections to find these active vulnerabilities. Following a responsible disclosure, the PyPI security team successfully revoked all 62 tokens and implemented new admin tooling to streamline future disclosures, highlighting the critical need for developers to scan for secrets, use project-scoped tokens, and properly configure 

Python flaw allowed attackers to forge Admin-Level API requests
Source:

A critical authentication bypass flaw (that has since been 

 release management API went undetected for over a decade. It allowed attackers to impersonate admins by pairing a valid username with an arbitrary API key. If exploited, attackers could have altered official download and signature verification URLs to orchestrate massive global supply chain attacks, though they could not directly modify the source binaries. The Python Security Response Team (PSRT) quickly patched the vulnerability within 48 hours of its disclosure, and subsequent forensic audits confirmed 

Understanding the transition from K8s Dashboard to Headlamp
Source

Following the archiving of the Kubernetes Dashboard, Headlamp has emerged as its modern successor. Headlamp preserves some of the familiar visual workflows, resource views, and even RBAC-compliant editing. However, it expands on those capabilities beyond the traditional, single-cluster view. Headlamp introduces multi-cluster management, application-centric 

, and extensibility through community or custom plugins (such as GitOps and AI assistants). Headlamp offers flexible deployment options as both an in-cluster tool and as a desktop app.



Kubernetes finally has User Namespace support
Source

’s general availability of user namespace support (

) successfully mitigates certain container escapes by remapping root users to unprivileged host UIDs, it fails to solve the critical shared kernel problem. In fact, granting namespaced capabilities actually increases the reachable host kernel attack surface by 

. This exposes vulnerable subsystems like 

 to unprivileged containers. As AI-assisted tools rapidly accelerate the discovery of exploitable kernel bugs that entirely bypass namespace protections, Kaylin argues that true multi-tenant isolation cannot be achieved at the UID layer.



Introducing Minimus Community Edition
Source:

Minimus just opened its entire catalogue of secure container images to everyone, for free! The new Community Edition gives any developer hundreds of continuously built-from-source, near-zero CVE images, with no registration, auth wall, or procurement. FIPS, CIS, NIST SP 800-190, and STIG compliance come built in. These are the same images Minimus customers already run in production across finance, government, and healthcare.



Open source maintainership in the age of AI
Source:

The rapid rise of AI-assisted coding has made generating code much faster, but it has also strained the maintenance of open-source projects. To address this, the Kubernetes community has introduced an AI policy that embraces these tools while enforcing strict human accountability. Kubernetes requires transparency, human-only engagement, and thorough manual verification. Additionally, the project is actively experimenting with automated AI review tools like GitHub Copilot and CodeRabbit to act as quality gates and reduce maintainer burnout, marking a mature step toward balancing technological innovation with human oversight.

SpaceX Buys Cursor In Largest Startup Acquisition Ever At $60 Billion
Source

In an all-stock deal valued at $60 billion, SpaceX has acquired Anysphere, the parent company of the AI coding tool Cursor, marking the largest venture-backed startup acquisition in history. Expected to close in the third quarter of 2026 following SpaceX’s recent $75 billion IPO, the deal integrates Cursor's advanced capabilities and vast developer user base with Elon Musk's xAI and Grok model.



Cursor quietly acquires Continue, an open-source alternative to Copilot
Source:

In a quiet consolidation move, Cursor had acquired Continue, a popular open-source alternative to GitHub Copilot with over 34,000 GitHub stars. Following Cursor's recent acquisition by SpaceX, this deal came as a shock to users. Continue's proprietary services are winding down, and users have until July 15th to export their data. However, the founding team pushed a final 2.0.0 update removing telemetry and handed the codebase over to the community, allowing the open-source project to remain publicly available for future development under its 

Fake AI agent skill passed all scans and reached 26,000 agents
Source:

To demonstrate critical flaws in AI agent security, security firm AIR successfully deployed a deceptive AI skill that bypassed multiple security scanners, inherited 36,000 GitHub stars via a repository merge, and reached roughly 26,000 agents (including corporate accounts) through targeted Instagram ads. The skill slipped past scanners by initially linking to legitimate documentation on an external domain controlled by AIR, only to swap the destination for a data-collecting payload after passing review.



Nvidia “open-sourced one of the most important AI projects right now”
Source:

 on Github, a security scanner designed to protect users from malicious or vulnerable AI Skills. These executable code packages that agents will run to perform specific automated tasks are scannable for security blind spots. Since these imported skills run with the same system access as the user, they pose severe security risks like credential harvesting, data leaks, and prompt injection, with research showing 1 in 4 public skills contain vulnerabilities.



Designing the hf CLI as an agent-optimised way to work with the Hub
Source:

The Hugging Face team started rebuilding the 

 CLI with AI agents in mind. The CLI now detects when an agent is using it and gives clean, token-efficient output, next-command hints, and more, all designed to minimise the number of tokens and steps an agent needs to get things done on the Hugging Face Hub. Hugging Face benchmarked it across 18 Hub tasks on Claude Code and Codex: without the 

 CLI, using curl or the Python SDK took up to 6x as many tokens on complex tasks, and the CLI completed them more reliably.



 license. Designed to eliminate production bottlenecks like latency and high costs, it only activates 2.5B parameters per token, cutting inference time in half compared to similar-sized models. Mellum2 acts as a fast, cost-effective focal model for software engineering workflows, excels at routing, low-latency RAG pipelines, and sub-agent orchestration.


We all depend on open source. We will defend it together.
Source:

Launched on June 25th, Akrites is the largest coordinated effort in history to secure the open-source software powering the world's critical infrastructure. While traditional vulnerability discovery used to take an expert weeks, AI can now find multiple serious flaws in mere minutes, rapidly outpacing the capacity of open-source maintainers. To prevent a flood of uncoordinated, duplicative reports from burying these maintainers, Akrites establishes a single, confidential, and trusted upstream clearinghouse to validate, remediate, and responsibly disclose vulnerabilities. The initiative commits real funding, engineering talent, and AI defense technologies to fix critical software at the source and accelerate downstream patch deployment before adversaries can exploit the code.



The Swift package registry has joined Apple
Source:

The Swift Package Index has joined Apple in order to build a comprehensive, robust package registry for the community. The platform, which recently surpassed 10,000 indexed packages and processes millions of compatibility builds across multiple platforms, will maintain its core vision and remain open source. For developers and package authors, the index will continue to operate as usual, while future collaborations between Apple engineers and the open-source community will focus on scaling the platform, and improving overall security capabilities.



CocoPods - Sunsetting a Package Manager
Source:

On December 2nd, the CocoaPods trunk will become permanently read-only, stopping new pod and version submissions due to maintainer shortages, the dominance of Apple's Swift Package Manager, and infrastructure security liabilities. To ensure existing dependencies continue resolving seamlessly, CocoaPods will offload its data to 

, though this shift introduces long-term maintenance challenges for active libraries that can no longer push security patches to their canonical coordinates.



To combat the rising threat of malicious software supply-chain attacks, Cloudflare has released 

, an open-source tool that intercepts metadata requests for popular package managers (

) to block dangerous dependencies. Operating as a network proxy via 

 rather than requiring complex client-side software wrappers, it automatically enforces inline safety policies, such as requiring packages to be at least 10 days old and verifying upload mechanisms, and then returns a 404 for any package failing inspection.



New CRAN Packages: signal or noise?
Source:

Joseph Rickert questions whether the rapid growth of new CRAN packages truly benefits the R community or if it is just noise. Spurred by the ease of modern software deployment, the monthly volume of submissions has exploded, mirroring a broader, Agentic AI-driven surge in low-utility digital apps. Rickert argues that most new packages fail to make a meaningful contribution, pointing out that many lack basic documentation like 

, ultimately rendering them undiscoverable and ineffective for end users.



Athena coalition already shipped 2,000 patches across 500 projects
Source:

Athena is a newly launched industry coalition of over two dozen orgs (including Cisco, Cloudflare, and Docker) designed to pool, patch, and neutralise open source vulnerabilities under embargo before public disclosure. Driven by the rapid, AI-fuelled escalation of zero-day exploits, the group uses frontier AI programs (like OpenAI's 

) to catch flaws that human reviewers and fuzzers miss. Already active with 2,000 patches across 500 projects, Athena provides members with early access to hardened builds while implementing internet-wide, platform-level mitigations to protect critical infrastructure that cannot patch quickly.



Microsoft announces Azure Container Apps Sandboxes (Preview)
Source:

Agentic AI changes the rules. Your AI generated code can't run next to your app. It has to be isolated in a safe dedicated space. Azure Container Apps Sandboxes provide fast, hardware‑isolated microVMs that agents can spin up on demand to safely execute untrusted code, persist state via snapshots, and scale to hundreds. This is the same underlying infra behind GitHub Copilot Sandboxes & Azure Foundry Hosted Agents. Now available as public preview.

Free Artifact Security Maturity Assessment

 | Where does your supply chain security actually stand? 

Cloud Native Digest - June 2026

Welcome to the July 2026 edition. In this issue, we’re tackling the real-world realities of modern software defense, from why high vulnerability scores can misrepresent actual risk of exploitation to the ways that AI agents are escaping existing sandbox boundaries, as seen with the Hugging Face and OpenAI fallout. Plus, we break down critical supply chain stories across 

. Let’s jump straight into the analysis.

Supply Chain Security in the Month of July

Why higher CVSS vulnerabilities aren't always the most exploited
Date: 

July 1st 2026

The Sysdig Threat Research Team observed the first known in-the-wild exploitation of 

Cloudsmith Blog

Cloud Native Digest - May 2026

Cloud Native Digest - June 2026

Cloud Native Digest - July 2026