Supply Chain · Watch Sunday · 14 June 2026 End-of-day synthesis 4 watches · 1 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A rare quiet day across the registries, with the lone headline a decade-long hijack of a target's authentication stack that reframes identity as the supply chain's deepest dependency.

The package registries were quiet today, and that is the bright spot. GHSA, the active-attack feeds (Socket, Phylum, Aikido), and CISA's KEV catalog all came up empty for the 24 hours to 18:00 ET — no new malicious packages, no fresh KEV adds since Tuesday's Oracle PeopleSoft entry.

The day's one story isn't a package compromise at all. BleepingComputer reported a China-nexus actor that held a target's authentication stack for roughly a decade, retaining full visibility into administrative activity on a network its operators believed was isolated. It rhymes with the supply chain's hardest problem: once an adversary owns the identity layer, every downstream trust decision — CI runners, signing keys, internal mirrors, admin sessions — inherits the compromise, and air-gapping buys far less than assumed.

→ Operational priority for the night treat your IdP as a crown-jewel dependency — audit for long-lived service principals and tokens, alert on auth-config changes that outlive the engineer who made them, and stop assuming network isolation substitutes for identity integrity.

06:00 ET · Morning Watch

Context · BleepingComputer · 2026-06-14 ·added 06:00 ET

Chinese threat actor held a target's authentication stack for ~10 years, retaining full visibility into administrative activity on an isolated network

BleepingComputer reports a China-nexus actor that took control of a target organization's authentication stack and maintained persistence for roughly a decade, with full visibility into administrative activity even on a network described as isolated. This isn't a package-ecosystem compromise, but it rhymes with the supply chain's hardest problem: once an adversary owns the identity/auth layer, every downstream trust decision — CI runners, signing, internal package mirrors, admin sessions — inherits the compromise, and air-gapping buys far less than assumed. Treat your IdP and auth stack as a crown-jewel supply chain of their own: audit for long-lived service principals and tokens, alert on auth-config changes that outlive the engineers who made them, and don't assume network isolation substitutes for identity integrity.