🧰 StepSecurity AI Package Analyst

The items that name it 4

• OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
  writeup2026-10-24It is written here as StepSecurity AI Package Analyst: evaluates release artifacts by their contents, such as build metadata that disagrees with the release tag..
• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeup2026-10-08

  Continuously monitors npm and PyPI for suspicious releases, scores supply chain risk based on tarball contents; detected the tensorlake 0.5.144 release

• SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors
  writeup2026-10-05

  Flagged @subql/common@5.8.3 as a suspicious npm release on October 5, 2026; source of the StepSecurity OSS Security Feed finding.

• Active Supply Chain Attack: Malicious node-ipc Versions Published to npm
  writeup

  Continuously monitors the npm registry for suspicious releases in real time, scoring packages for supply chain risk; detected this node-ipc incident and the compromised versions within minutes of publication