Supply Chain Attacks Are Getting Worse—How to Shrink Your Exposure

A detailed breakdown of two major 2026 supply chain attacks — the compromise of the open-source vulnerability scanner, and the npm-based attack on the widely used HTTP client — and practical defenses to limit exposure. Key recommendations include eliminating 'latest' tag usage, implementing cool-down periods before adopting new package versions, requiring immutable release tags, using automated dependency management tools like, and maintaining short-lived credentials with least-privilege access. The post also explains how blast radius separation at the infrastructure level can contain damage when a compromise does occur.