--- title: Best Supply Chain posts of 2025 | daily.dev description: The most upvoted Supply Chain posts of 2025, curated by the daily.dev community. canonical: https://daily.dev/tags/supply-chain/best-of/2025 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/tags/supply-chain/best-of/2025 og:type: website og:site_name: daily.dev og:title: Best Supply Chain posts of 2025 | daily.dev og:description: The most upvoted Supply Chain posts of 2025, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of Supply Chain — 2025 1. 1 [](/posts/whatsapp-api-worked-exactly-as-promised-and-stole-everything-v5sijobfe "WhatsApp API worked exactly as promised, and stole everything") Article InfoWorld · 42w WhatsApp API worked exactly as promised, and stole everything A malicious npm package called "lotusbail" masqueraded as a legitimate WhatsApp Web API library for six months, accumulating over 56,000 downloads. The package functioned correctly while secretly stealing messages, credentials, and contact data through a proxy layer that intercepted all operations. It used four layers of obfuscation and RSA encryption to exfiltrate data to attacker-controlled servers. Most critically, it exploited WhatsApp's multi-device pairing to maintain persistent access even after package removal, requiring manual device unlinking. The package remains available on npm, highlighting the limitations of traditional security checks against supply-chain attacks that mimic legitimate behavior. 127 5 2. 2 [](/posts/the-ram-shortage-comes-for-us-all-bvsk3yx5w "The RAM Shortage Comes for Us All") Article Jeff Geerling · 45w The RAM Shortage Comes for Us All RAM prices have skyrocketed dramatically in recent months, with some DDR5 kits jumping from $209 to $650\. The shortage is driven by memory manufacturers prioritizing AI datacenter production over consumer markets, forcing companies like Raspberry Pi to raise prices and Micron to exit the consumer memory business entirely. Small vendors face even worse price increases, with some memory modules tripling or quadrupling in cost. Unlike previous shortages, the specialized nature of AI hardware means there won't be a flood of cheap consumer-compatible parts when the bubble bursts. PC builders, SBC enthusiasts, and smaller manufacturers are being hit hardest, with the situation expected to continue affecting any product containing memory. 60 17 3. 3 [](/posts/compromise-of-npm-packages-highlights-supply-chain-vulnerabilities-gnbawgdh4 "Compromise of npm Packages Highlights Supply Chain Vulnerabilities") Article Collections · 1y Compromise of npm Packages Highlights Supply Chain Vulnerabilities A major security breach compromised 18 popular npm packages including debug and chalk through a phishing attack on maintainer credentials. The malicious code targeted cryptocurrency transactions by intercepting wallet interactions in browsers, though no funds were reportedly stolen. This represents the largest supply chain attack in npm's history, affecting packages with billions of weekly downloads. 40 3 4. 4 [](/posts/a-rough-week-for-hardware-companies-h3dnnvti1 "A rough week for hardware companies") Article TechCrunch · 42w A rough week for hardware companies Three hardware companies—iRobot, Luminar, and Rad Power Bikes—filed for bankruptcy within a week, facing similar challenges despite selling different products (robotic vacuums, lidar sensors, and e-bikes). Common issues included tariff pressures from Chinese manufacturing dependencies, failed major acquisition deals (notably iRobot's blocked Amazon acquisition), pandemic-driven revenue peaks followed by steep declines, and inability to diversify beyond their flagship products. The bankruptcies highlight structural challenges in hardware manufacturing, including supply chain concentration in China and difficulty maintaining growth after initial product success. 26 2 5. 5 [](/posts/building-a-dynamic-inventory-optimisation-system-a-deep-dive-yg81fkllg "Building a dynamic inventory optimisation system: A deep dive") Article Zalando · 1y Building a dynamic inventory optimisation system: A deep dive Zalando built a scalable inventory optimization system that combines demand forecasting and replenishment optimization to help e-commerce partners manage millions of SKUs across multiple warehouses. The system uses a two-step approach: generating probabilistic demand forecasts with LightGBM and Nixtla's MLForecast, then applying Monte Carlo simulations with gradient-free optimizers to minimize inventory costs. The architecture leverages AWS services including SageMaker, Databricks, and feature stores to provide both real-time interactive recommendations and daily batch processing, handling 5 million SKUs with 2-hour processing times. 26 6. 6 [](/posts/how-does-this-keep-happening--aprui2beq "how does this keep happening?") Video Low Level Learning · 2y how does this keep happening? A backdoor in a Go programming language module was active for over 3 years due to a supply chain attack, exploiting a Go module mirror's caching system. This highlight emphasizes the inherent risks associated with relying on third-party code in languages like Go, Python, Rust, and JavaScript. The attack utilized typo squatting to trick developers into downloading malicious packages. Despite the malicious GitHub package being cleaned up, the security loophole underscores the need for better verification and review processes for cached packages. 23 1 7. 7 [](/posts/npm-sees-surge-of-auto-generated-elf-stats-packages-publis--6rymn7sfv "npm Sees Surge of Auto-Generated “elf-stats” Packages Publis...") Article Socket · 45w npm Sees Surge of Auto-Generated “elf-stats” Packages Publis... Socket's Threat Research Team discovered over 420 automated malicious packages published to npm following an "elf-stats" naming pattern. These packages were published every two minutes from newly created accounts and contained simple malware variants. npm has begun removing the affected packages, but the automated publishing continues with new variations appearing. Developers should avoid installing any packages matching the elf-stats-\* pattern until they can be verified as safe. 22 5 8. 8 [](/posts/i-never-thought-i-d-see-this-higqjrbog "I Never Thought I’d See This") Video Low Level Learning · 48w I Never Thought I’d See This A remote code execution vulnerability was discovered in tokio-tar, an unmaintained Rust library for async tar file processing. The flaw stems from a logic bug in how the library parses tar headers, allowing attackers to smuggle malicious files inside archives that bypass security scanners. The vulnerability affects tools like UV (Python package manager) and container images, enabling file overwrites during extraction. This case highlights that while Rust prevents memory safety issues, logic bugs remain possible, and abandoned dependencies pose significant security risks. 22 2 9. 9 [](/posts/introducing-net-support-in-socket-lqatfjub0 "Introducing .NET Support in Socket") Article Socket · 1y Introducing .NET Support in Socket Socket has announced public beta support for .NET, offering enhanced security and supply chain protection for developers using C# and the .NET ecosystem. This includes deep package inspection, automatic detection of risky updates, and improved SBOM accuracy. The integration aims to provide seamless security without disrupting workflows. Additionally, the complexities of .NET dependency resolution and the importance of lock files for consistent, secure builds are highlighted. 10 [See all Supply Chain archives](/tags/supply-chain/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/tags/supply-chain/best-of/2025#page","url":"https://daily.dev/tags/supply-chain/best-of/2025","name":"Best Supply Chain Posts of 2025","description":"The most upvoted Supply Chain posts of 2025, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/tags/supply-chain/best-of/2025#items","numberOfItems":9,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/whatsapp-api-worked-exactly-as-promised-and-stole-everything-v5sijobfe","name":"WhatsApp API worked exactly as promised, and stole everything"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/the-ram-shortage-comes-for-us-all-bvsk3yx5w","name":"The RAM Shortage Comes for Us All"},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/compromise-of-npm-packages-highlights-supply-chain-vulnerabilities-gnbawgdh4","name":"Compromise of npm Packages Highlights Supply Chain Vulnerabilities"},{"@type":"ListItem","position":4,"url":"https://daily.dev/posts/a-rough-week-for-hardware-companies-h3dnnvti1","name":"A rough week for hardware companies"},{"@type":"ListItem","position":5,"url":"https://daily.dev/posts/building-a-dynamic-inventory-optimisation-system-a-deep-dive-yg81fkllg","name":"Building a dynamic inventory optimisation system: A deep dive"},{"@type":"ListItem","position":6,"url":"https://daily.dev/posts/how-does-this-keep-happening--aprui2beq","name":"how does this keep happening?"},{"@type":"ListItem","position":7,"url":"https://daily.dev/posts/npm-sees-surge-of-auto-generated-elf-stats-packages-publis--6rymn7sfv","name":"npm Sees Surge of Auto-Generated “elf-stats” Packages Publis..."},{"@type":"ListItem","position":8,"url":"https://daily.dev/posts/i-never-thought-i-d-see-this-higqjrbog","name":"I Never Thought I’d See This"},{"@type":"ListItem","position":9,"url":"https://daily.dev/posts/introducing-net-support-in-socket-lqatfjub0","name":"Introducing .NET Support in Socket"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tags","item":"https://daily.dev/tags"},{"@type":"ListItem","position":3,"name":"Supply Chain","item":"https://daily.dev/tags/supply-chain"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/tags/supply-chain/best-of"},{"@type":"ListItem","position":5,"name":"2025"}]}]} ```