Npm

• Jun 21, 2026 How Supply Chain Attacks Actually Work: The Anatomy of XZ, SolarWinds, and the npm Sagas

  Supply chain attacks do not break down the front door — they get invited in through the build systems, package registries, and maintainer trust that modern software runs on. A forensic walk through the XZ Utils backdoor, SUNBURST, and the npm registry attacks, the pattern they share, and the defenses that actually survive contact with real codebases.