Three supply chain attacks hit npm, PyPI, and Docker Hub between April 2123, 2026. All three targeted secrets: API keys, cloud credentials, SSH keys, and tokens from developer environments and CI/CD pipelines.
First seen on securityboulevard.com
Jump to article: securityboulevard.com/2026/04/no-off-season-three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours/
