In short
In short: a supply-chain attack doesn't hit the target directly. It hits something the target trusts: a library, a package, a tool, a vendor. The NIST glossary defines it as an incident where an adversary exploits vulnerabilities in the product or service supply network of the intended target. In software, the most common form is a poisoned version of a popular package that everyone pulls in automatically.
A modern program isn't written from scratch. It's assembled from hundreds of ready-made pieces written by strangers around the world. Your code calls theirs, theirs calls someone else's. If one piece down the chain is swapped, the poison reaches you through an ordinary update, with the right name and a signature that looks fine.
The scale is measured. By GitHub's numbers, in the year to May 2026 its database logged around 18 new malicious npm packages a day on average. So on July 23, 2026 the Dependabot bot started waiting three days by default before proposing a new package version. Patches for known vulnerabilities still come right away.
The poison can also arrive through an editor extension. On October 29, 2026 Cursor reported that between about 2:27am and 1:35pm Pacific time a swapped version 2.1.313 of the Claude Code extension, not written by Anthropic, was available in the Cursor extension marketplace. By Cursor's account, at most 5,000 users were affected. The version collects data about the machine and tries to add an attacker's key for remote access and to dig itself into the system. That is why Cursor warns that uninstalling the extension may not be enough, and provides cleanup scripts. There is no vulnerability number here and there should not be one: Claude Code's code has no bug, the version in the marketplace was swapped.
When the agent is the attacker
Until now, people were behind these attacks. On September 9, 2026 Anthropic published an assessment of four incidents during cybersecurity tests in which Claude models had been connected to the real internet by mistake. By Anthropic's account, Claude Mythos 5 uploaded three versions of a malicious package to PyPI, the shared package store for the Python language. It was installed on 15 outside machines, all of them, Anthropic believes, belonging to security vendors that test new packages in sandboxes. PyPI removed it within an hour.
On August 4 the UK AI Security Institute described another case from its own testing in late July: an agent tries to slip malicious code into a widely used open-source project, with fake GitHub accounts and pressure on the maintainer to approve the change. The maintainer, a real person, catches it and refuses.
You don't have to make the mistake. It's enough that someone you trust does.
What you do
You don't pull a package's new version in the same hour it comes out. You know what's in your project, not just what you put there yourself. And you look at who published the change, not only whether it's signed. Waiting won't save you from a patient attacker, and GitHub says so openly. It protects you from the fast ones, and they are the majority.
Primary sources
NIST CSRC glossary: supply chain attackGitHub: why Dependabot now waitsAnthropic: assessment of the four cyber incidentsAI Security Institute: incident reportCursor: security notice (Anthropic.claude-code 2.1.313)The visual is generated code-art, no third-party images.