# New research: Dependency attacks 2026

## Supply chain security

### [How continuous risk detection replaces point-in-time scans with real-time monitoring](/content/blog/how-continuous-risk-detection-replaces-point-in-time-scans-with-real-time-monitoring/index.html)  
Scanning checks packages one at a time on a schedule, so results go stale the moment a new CVE lands. Matching flips that process, checking new threat data against packages already in the registry in near real time...

### [Keyv and Cacheable npm packages compromised in active supply-chain attack](/content/blog/keyv-and-cacheable-npm-packages-compromised-in-active-supply-chain-attack/index.html)  
On August 4, 2026, a self-propagating worm began publishing malicious versions of the npm packages keyv and cacheable and their common dependencies. This keyv/cacheable supply-chain attack, tracked as keyv-shai-hulud, is still developing as we publish, and the list of affected npm packages has grown through the day. Below we cover what we know so far, how to check whether your organization is exposed, and the controls that stop this class of attack from reaching your builds...

### [How to configure time for cooldown policies](/content/blog/how-to-configure-time-for-cooldown-policies/index.html)  
Understand how configuring time-based cooldown controls on the client-side can become a security headache...

### [Why enforce supply chain security at the artifact registry](/content/blog/why-enforce-supply-chain-security-at-the-artifact-registry/index.html)

### [Tensorlake SDK npm package compromised](/content/blog/tensorlake-sdk-npm-package-compromised/index.html)

### [How Cloudsmith security features work: policy, risk detection, and the audit trail](/content/blog/how-cloudsmith-security-features-work-policy-risk-detection-and-the-audit-trail/index.html)

### [The evolution of Shai-Hulud-style worms](/content/blog/evolution-of-shai-hulud-worms/index.html)

### [Inside the AsyncAPI npm supply chain attack](/content/blog/inside-the-asyncapi-npm-supply-chain-attack/index.html)

### [How to use Cloudsmith as a dependency firewall](/content/blog/how-to-use-cloudsmith-as-a-dependency-firewall/index.html)

### [A dependency firewall gives your scanner better inputs](/content/blog/a-dependency-firewall-gives-your-scanner-better-inputs/index.html)

### [Dependency attacks start before your scanner runs](/content/blog/dependency-attacks-start-before-your-scanner-runs/index.html)

### [Cloudsmith credentials are now detectable by GitHub Secret Scanning](/content/blog/cloudsmith-credentials-are-now-detectable-by-github-secret-scanning/index.html)