@dreamsofcode_io: Really good time to consider putting your SSH Keys on a hardware security key, such as a Yubikey.
Summary
A tweet recommends using hardware security keys like Yubikey for SSH keys, referencing an active cross-ecosystem supply chain attack (TrapDoor) on npm, PyPI, and Crates.io involving malicious packages and crypto-stealing malware.
View Cached Full Text
Cached at: 05/26/26, 02:47 AM
Really good time to consider putting your SSH Keys on a hardware security key, such as a Yubikey.
Socket (@SocketSecurity): 🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.io.
Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems.
TrapDoor targets
Similar Articles
@altryne: PSA: If you are un-aware of the latest supply-chain attacks, or aware but complacent and didn't do anything, especially…
A PSA about a series of supply-chain attacks targeting AI developer tools (Hermes, OpenClaw) via npm and PyPI, specifically the 'Mini-Shai Hulud' worm that self-replicates and steals credentials, API keys, and browser sessions. The post advises sandboxed execution and restricting package age to mitigate risks.
Keyv and friends compromised in active Shai-Hulud supply chain attack
Attackers compromised the GitHub account of the maintainer behind keyv and related npm caching libraries, injecting a credential-stealing worm across multiple packages with over 2 billion combined monthly installs.
@RhysSullivan: just enabled a minimum age on npm package installs for my machine, should've done this sooner but if you haven't either…
A developer shares a tip to configure a minimum release age for package installs to mitigate supply-chain attacks.
Disrupting supply chain attacks on NPM and GitHub Actions
GitHub announces new security measures for npm and GitHub Actions to disrupt common supply chain attack techniques, including preventive account protection for high-impact accounts and safer default checkout settings.
Gave my coding agents SSH access to real servers without putting keys in their environment - here's the trust model
The author presents a secure method for giving coding agents SSH access to real servers using an intermediary client that holds keys and signs commands, with per-host policies, live monitoring, and audit logs, while discussing limitations and seeking feedback.