Software Supply Chain Security: May 2026 Roundup

In May, the cloud-native ecosystem witnessed an alarming surge in software supply chain attacks affecting various platforms and packages, as reported by Nigel Douglas from Cloudsmith. Key incidents included the GlassWorm malware campaign, which targeted software developers by embedding data-stealing malware in popular repositories, and the Sicoob.Sdk NuGet package that posed as a legitimate banking library to steal credentials. Other notable attacks involved npm packages such as the mouse5212-super-formatter, which exploited directory data from Anthropic's Claude AI tool, and the terminal3airport account, which published numerous adware packages. The Mini Shai-Hulud campaign continued to compromise npm and PyPI packages, while the Megalodon attack focused on GitHub repositories, highlighting the persistent threat to modern software supply chains. In response, efforts to enhance security measures, such as introducing trusted publishing for npm and implementing multi-factor authentication, were emphasized to mitigate the risks of such attacks.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.