SolarWinds
Distributed a compromised update to 18,000 customers
A build system with excessive permissions and too many trusted components turned one compromised dependency into an update every customer installed.
All case studies
Supply Chain
6 case studies tagged supply chain.
npm / event-stream
A package thousands of projects trusted changed hands
A popular package changed hands, and the code that arrived with the new maintainer took cryptocurrency wallets from the projects that installed it.
Kaseya
An RMM agent carried one compromise into 1,500 businesses
A remote monitoring agent with extensive permissions across customer networks turned into a lateral movement tool once it was compromised.
Chromium
Requires security approval to add a third-party library
A new dependency is not accepted on merit alone: the request has to say what it costs to build, ship, update and own for as long as it ships.
Codecov
A modified uploader lifted secrets out of customer pipelines
Attackers edited Codecov's bash uploader to exfiltrate environment variables from CI/CD pipelines, exposing thousands of customer secrets.
Mastra
Removed the npm token bypass after 116 packages were published
A token tied to a single compromised maintainer published 116 malicious packages in twenty-five minutes; the fix was deleting the bypass that let tokens publish at all.