Supply Chain Security Crisis Peaks

ChainDrop hijacked keyv, a package with roughly 150M weekly downloads, while retaining valid SLSA provenance and using Ethereum C2 plus persistence in Claude Code and VS Code. JFrog Artifactory's exploited admin-token flaw, active Langflow code-execution exploitation, Mythos 5's autonomous attack attempt, Gemini CLI's CVSS 10.0 issue, and GitHub's still-preview network firewall keep supply-chain risk at a high point.