Software supply chain security best practices for 2026

Aikido Intel analyzed millions of package versions and confirmed thousands of malicious packages, documenting multiple active supply-chain campaigns (malicious npm packages, compromised CI actions, trojaned editor extensions, impersonated MCP servers and prompt-injection attacks) that resulted in credential theft, widespread repository exposure, and forced installs; the report details those incidents and provides prioritized, practical controls (age gates, ignore-scripts, lockfiles, pinning, token scoping, FIDO2, install-time detection, SBOMs, and incident playbooks) to mitigate future supply-chain compromises.