Supply Chain Attacks

Supply chain attacks indirectly infiltrate downstream users through open-source packages, development tools, CI/CD pipelines or trusted vendors. Recent incidents have centered on the NPM, PyPI and GitHub ecosystems, as well as AI development tools. North Korean hackers and groups including APT32 have also targeted cryptocurrency and fintech companies in attempts to steal credentials, wallet private keys and assets. Because malware can spread rapidly through updates and AI agent tools may expand the scope of execution, these risks warrant continued monitoring.