Threat feeds miss day-zero npm and PyPI attacks

Conventional threat intelligence feeds, including multi-engine scanners like VirusTotal and specialized reputation tools, miss the vast majority of software supply chain attacks on day zero and months after public disclosure. Researchers evaluated hundreds of network indicators and payload hashes across major supply chain campaigns and found blind-spot rates exceeding 70% to 90%. The author argues that general-purpose security tools fail because they are built to detect inbound perimeter probes and compiled binaries, whereas supply chain attacks execute outbound from trusted developer environments using interpreted scripts and low-noise, ephemeral infrastructure. Open article →