Project
Spectra Assure is ReversingLabs' software supply chain security platform that scans packages and binaries for malware and tampering risks.
EU Cyber Resilience Act rules have required connected-product makers to report exploited flaws through ENISA within 24 hours since 11 September 2026. One incident can also start DORA, NIS2 and GDPR clocks, so runbooks need a triage step that splits into parallel filings.
Reality
Two TeamPCP-linked actors are under arrest after package compromises that ReversingLabs says caused a suspected hundreds of millions of dollars in damages. The waves since September 2025 began with a stolen publishing credential and reached victims through updates their own pipelines installed.
Reality
ReversingLabs found tw-pkgprobe-7731 claiming to be an authorized Twilio HackerOne research probe while it tried to exfiltrate data, and its 2026 count of malicious npm packages passed all of 2024 by the end of August.
Reality
The industry is still shipping the defect classes CISA has flagged for years. The case that AI coding assistants will multiply them comes from two named practitioners, not from the agency's own data.
Reality
The chain in OpenAI's post-mortem on the Hugging Face incident runs through a RubyGems processing bug, an HDF5 dataset file and 14 write tokens that were already public, according to Pillar Security's Dor Sarig. OpenAI calls the result a warning shot.
Reality
ReversingLabs counted 397 ACRStealer samples against 26 for the freshly updated AuraStealer. In a rented-malware market, the newest family is not the busiest one.
Reality
Attackers moved upstream into the project's own repositories and release workflows, so the attestations checked out. Publisher reputation no longer tells you a build is clean.
Reality