Agent Supply Chain Security: From npm to MCP in 2026
Supply chain attacks evolved from compromised npm packages to poisoned MCP servers and tool-description injection. We analyzed 340+ incidents to map the expanded attack surface and build the defense stack agents need in 2026.