Why EDR and proxy won’t save you from supply chain malware

The report explains that developer-focused supply-chain malware bypasses traditional EDR and proxy defenses because malicious code executes inside trusted runtimes (e.g., npm postinstall or Python package import) and performs normal-looking actions. It cites an npm maintainer account compromise that added a postinstall RAT and a backdoored Python package that harvested AWS/Azure/GCP/Kubernetes credentials and spread using legitimate tooling, arguing that detection requires on-device, install-time protections.