Xe Iaso: 'Maybe You Shouldn't Install New Software for a Bit' — Supply Chain Attack Window Advisory Hits HN Frontpage at 532 Points

Xe Iaso·medium signal

Xe Iaso published a widely-shared advisory noting the current moment is 'one of the best times for a supply chain attack via npm to hit hard,' recommending a moratorium on installing new software for a week. Context: the LiteLLM compromise (March 2026, 95M monthly PyPI downloads, 3-stage payload), axios npm compromise, and QLNX RAT targeting developer credentials have created a concentrated threat window. The advisory gained 532 HN points, reflecting broad community concern about the compounding supply chain attack surface.