Skip to content
Threat Feed
Subscribe

Tag

Software-Security

2 briefs RSS
high threat

Analyzing Supply Chain Risks in Python Package Installation

Threat actors, including TeamPCP, are increasingly using malicious Python packages in supply chain attacks to compromise developer devices and infrastructure by exploiting trust in Python's packaging ecosystem, leading to automatic payload execution during installation.

PyPI +2 TeamPCP supply-chain python software-security
2t 4i
high advisory

Sigstore `certificateOIDs` Verification Bypass Vulnerability (CVE-2026-48815)

A high-severity vulnerability (CVE-2026-48815) in the `npm/sigstore` library (versions <= 4.1.0) causes the `certificateOIDs` verification constraint to be silently ignored, allowing applications to accept unauthorized certificates that should have been rejected based on extension policy, which could lead to supply chain attacks by trusting malicious artifacts.

npm/sigstore vulnerability supply-chain software-security javascript npm code-signing