In May 2026, CISA and G7 partners released voluntary guidance on Software Bill of Materials for AI - Minimum Elements. The guidance is intended to improve transparency in artificial intelligence systems and their supply chains.

CISA frames an SBOM as an "ingredients list" that helps organizations understand supply chains and make risk-informed decisions. For AI systems, that ingredients list needs to include more than ordinary software packages.

On 13 February 2026, the NIS Cooperation Group adopted the EU ICT Supply Chain Security Toolbox, developed by Member States with support from the European Commission and ENISA.

The European Commission describes the toolbox as a horizontal, common, non-binding approach for identifying, assessing, and mitigating cybersecurity risks in ICT supply chains. It recommends measures such as critical-supplier assessment, multi-vendor strategies, and reducing dependencies on high-risk suppliers.

On 31 March 2026, Google Threat Intelligence reported a software supply-chain attack against the widely used axios npm package. The attacker introduced a malicious dependency, plain-crypto-js, into axios npm releases 1.14.1 and 0.30.4.

The malicious dependency used a postinstall hook to deploy the cross-platform WAVESHAPER.V2 backdoor across Windows, macOS, and Linux. Google attributed the activity to a North Korea-nexus actor tracked as UNC1069.

Welcome to the SupplyChainSecurityHandbook.com project.