Software supply chain security: review, investigate, respond
Software supply chain security asks what code and access you trust before they reach a build or deployment. For a dependency change, that means more than the package name: review the resolved source, version, integrity information, install behaviour and the permissions available to the process that will run it.
Start with the lockfile checklist, then use the reproducible lab to practise reviewing a suspicious change. The lab uses synthetic fixtures and does not execute packages. The incident articles provide context for investigating your own exposure; a package appearing in a repository alone does not establish that a malicious version executed or that credentials were taken.
Review a dependency change before merging
Use the checklist to decide what deserves investigation, then compare your reasoning with the lab. Record what changed, the evidence you checked and what remains unknown instead of treating a clean scan as complete assurance.
Defensive Security
npm Lockfile Security Review: Checks Before You Merge
npm lockfile security review: check package sources, install hooks and integrity metadata, then record the evidence behind your merge decision.
Read the articleDefensive Security
Supply Chain Review: A Reproducible Lockfile Lab
Reproduce a supply-chain review with sample npm lockfiles, inspect the evidence, and retest configuration changes using BreachLine's browser tools.
Read the article
Investigate package and build-tool incidents
Read the incident timeline and linked sources, then check the affected versions, installation window and execution context in your own environment. Keep confirmed observations separate from possible downstream impact.
Threat Intelligence
The Axios npm Supply Chain Attack: What Teams Need to Know
Investigate the Axios npm supply chain attack using affected-version evidence, historical lockfiles, build records and credential exposure checks.
Read the articleThreat Intelligence
LiteLLM Supply Chain Attacks: Exposure and Response
Investigate LiteLLM supply chain exposure with affected-version checks, build evidence, credential scoping and a recovery worksheet for AI teams.
Read the articleThreat Intelligence
TeamPCP: The Group Turning Security Tools Into Malware
TeamPCP poisoned Trivy, Checkmarx, and LiteLLM in a 2026 supply chain campaign (CVE-2026-33634). Who they are, what they hit, and how to stop them.
Read the article
Follow trust beyond the package registry
Dependencies are not the only route into a workflow. Review how an agent accepts installation instructions and how connected services receive access. These articles examine the trust decisions around documentation and OAuth.
Threat Intelligence
llms.txt Is Directing Agents to Install Unowned Code
Researchers found 120 corporate llms.txt files pointing at packages nobody owned. Claude, Codex, and Hermes then installed them inside real networks.
Read the articleThreat Intelligence
Vercel Breach: One OAuth Token, Full Compromise
Vercel's April 2026 breach traces to one compromised third-party OAuth token from Context.ai. The full attack chain, the IOCs, and the lessons for your team.
Read the article
Tools and guides
Use the supply chain review tools
Inspect dependency and build inputs with the available browser-based tools.
Explore an SBOM
Inspect a software bill of materials as one input to a dependency review.
Review CI and build security
Explore tools for reviewing the configuration around software builds.