#Software Supply Chain

Supply Chain Attack Targets NPM Ecosystem: Hundreds of Malicious Packages Bypass Provenance

A hacker group, TeamPCP, stole maintainer accounts to publish over 600 malicious npm packages that bypassed Sigstore verification. This highlights major logic vulnerabilities in digital signatures and open-source supply chain risks.

Kenji·May 23, 2026·2 min read