The most striking supply-chain story in Help Net Security's weekly roundup concerns Ledger hardware wallets. Three days after Southeast Asian customers reported drained wallets, Ledger said all confirmed cases involved devices sold through reseller CryptoBilis and were linked to a $93M theft. The company described the damage as limited, though the incident underscores how a trusted hardware wallet can be compromised before it reaches the user.
Another supply-chain risk came from npm's Trusted Publishing feature. Bloom Security researchers found an attacker could publish new versions of another maintainer's package without stealing credentials, merely by registering a GitHub repository name the maintainer had abandoned. Bloom identified more than 1,500 exposed npm packages; GitHub, which owns npm, says fixes have been shipped. The two stories show supply-chain attacks are moving beyond traditional credential theft into platform misconfigurations and reseller trust.
Elsewhere in the roundup, Microsoft's October Patch Tuesday fixed over 1,400 bugs, including CVE-2026-96951, a Mark of the Web bypass exploited in the wild. Separately, a threat actor chained three Ivanti Connect Secure zero-days to gain root on fully patched VPN appliances. Both examples reinforce that patching alone is not enough when attackers find bypasses or chain multiple flaws.