Netcrook
#Supply Chain Security
When Suppliers Become the Attack Surface: Europe’s New Cyber Reality
Critical vendors are no longer a back-office issue: NIS2 and DORA are pushing supply-chain risk into the boardroom, where continuity and accountability now overlap.
When a Trusted Package Turns Toxic: The Mastra npm Intrusion
A hijacked maintainer path, a typosquat package, and two very different payloads show how supply-chain abuse can reach far beyond one namespace.
The Cloud Breaks First in the Blueprint
IaC security pushes defenses upstream, because in many cloud environments the most expensive mistake is not a live misconfiguration but the code that creates it.
When a Package Registry Turns into a Blind Spot for AI Builders
Microsoft’s attribution of a Mastra AI-related npm compromise to Sapphire Sleet shows how a software supply chain incident can ripple through developer tooling long before anyone notices a malicious build.
Italy’s Cloud Compliance Test Is Less About Paperwork Than Proving Control
NIS 2 is turning cloud security into an audit of identity, suppliers, incident handling, and evidence for organizations that fall within scope.
Cursor Meets the Launchpad: Why a Rumored SpaceX Buyout Changes the Risk Math for AI Coding
If the transaction closes, the real story is not the price tag but the security burden that comes with placing an AI coding platform inside a high-trust engineering environment.
Vertex AI’s Quiet Trust Break: A Python SDK Flaw With AI Supply-Chain Consequences
A critical flaw in Google Cloud Vertex AI SDK for Python raises a familiar security nightmare: when an AI workflow stops trusting its own artifacts, the damage can spread far beyond one notebook or one model upload.
CMMC Level 2 Is Not a Trophy - It Is a Test of Federal-Grade Control
Iron Bow’s certification announcement is best read as a compliance signal, not a blanket security claim, and it points to the growing pressure on suppliers to prove they can protect controlled government information.
Europe Turns Supply Chains Into a Cyber Defense Line
A new EU sovereignty push ties chips, cloud, AI, open source, and energy digitalization into one resilience agenda, shifting security thinking from products to dependencies.
When AI Moves Into Buying and Building, the Attack Surface Moves With It
An AI demo day in Milan spotlights a bigger shift: once models are used in production, supply chain, and procurement, security becomes a question of trust, data, and control, not just software performance.
When Diplomacy Meets the Jet Factory, Cyber Risk Follows the Blueprint
A London meeting between Japan and the UK points to more than political alignment: it highlights how modern defense cooperation now depends on software assurance, supplier trust, and tightly governed data flows.
The Quiet Power Shift Behind AI Governance
Two June policy moves point to a harder truth in AI security: control is moving from abstract principles to concrete chokepoints like access, hosting, and cross-border leverage.
Fake Fixes, Real Risk: How a 25-Package Supply Chain Trap Targeted Solana Developers
A package-based credential theft campaign shows how quickly trusted registries can become entry points when attackers dress malware up as a build fix or SDK helper.
NetRise Pushes Software Trust Into the Channel, Where Security Data Gets Used or Ignored
The company’s new Discovery Partner Program is a reminder that software supply chain security is no longer just about finding risk - it is about making the evidence usable by the teams that buy, deploy, and defend software.
Leak-Site Listing Puts a Semiconductor Supplier in the Extortion Crosshairs
A Worldleaks post naming Tata Electronics may point to data-extortion pressure, not proof of encryption, and the real risk sits in what could have been taken.
The Hidden Security Decision That Happens Before IT Is Even Bought
Procurement is not just a budget exercise: in modern IT buying, the vendor checklist can shape security posture long before any system goes live.
GitHub Became the Bait: A Developer Targeting Campaign Hides in Plain Sight
A Proofpoint-tracked cluster tied to the name UNK_DeadDrop puts developer trust, not platform bugs, at the center of a reported April-May 2026 campaign.
Shai-Hulud Returns With a Bigger Blast Radius Across npm and PyPI
More than 100 packages were hit in a new supply-chain wave, with Miasma and Hades emerging as the latest names in a self-propagating campaign.
The Quiet Risk Inside Every Build: Why Dependency Visibility Matters Now
A new roundup on Software Composition Analysis points to a larger truth in modern security: when applications depend on open-source code, knowing what is inside the build is a defensive necessity, not a luxury.
AI Code Is Moving Faster Than the Gatekeepers
AI-assisted development can speed delivery, but once code starts arriving through prompts and agents, security governance has to move upstream with it.