Add 2025 software supply chain attacks

[sivanahamer]

Adding attacks 2025 to the new repository mentioned in: cncf/tag-security#1503

[netlify]

✅ Deploy Preview for contribute-cncf-io ready!

Name	Link
🔨 Latest commit	c00ea6e
🔍 Latest deploy log	https://app.netlify.com/projects/contribute-cncf-io/deploys/6967acb6c29b0100085e885c
😎 Deploy Preview	https://deploy-preview-139--contribute-cncf-io.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull request overview

This pull request adds documentation for three significant software supply chain attacks that occurred in 2025 to the CNCF TAG Security catalog. The additions align with the catalog's mission to capture diverse attack patterns for developing best practices and tools.

Key Changes

• Added three 2025 supply chain compromise entries to the catalog index
• Created detailed documentation for the Shai-Hulud self-replicating worm attack on npm
• Created documentation for an npm phishing campaign targeting maintainer Qix
• Created documentation for the nullifAI malicious ML model incident on Hugging Face

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 8 comments.

File	Description
docs/community/tags/security-and-compliance/publications/catalog/index.md	Added three new 2025 entries to the supply chain compromises table with appropriate links and compromise types
docs/community/tags/security-and-compliance/publications/catalog/2025/shai-hulud.md	Documented the Shai-Hulud worm attack including impact, compromise type, and references
docs/community/tags/security-and-compliance/publications/catalog/2025/qix.md	Documented the npm phishing campaign targeting Qix with impact analysis and related incidents
docs/community/tags/security-and-compliance/publications/catalog/2025/nullifAI.md	Documented malicious ML models on Hugging Face with security implications

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 9 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

[castrojo]

Can you try to pass the DCO bot thing? Thanks!

[sivanahamer]

Done!

[nate-double-u]

Thanks for this @sivanahamer!

Since this is coming in from the tag-security, should the same folks who would have approved cncf/tag-security#1503 approve this before merge?

@mrbobbytables, is it the intention that each tag has sway over their section of this site?

[brandtkeller]

Thanks for moving this over to this repository and navigating the updates - appreciate the patience.

[brandtkeller]

@nate-double-u pausing to take final action on merge for any additional considerations from @mrbobbytables or yourself.

[mrbobbytables]

Thanks for this @sivanahamer!

Since this is coming in from the tag-security, should the same folks who would have approved cncf/tag-security#1503 approve this before merge?

@mrbobbytables, is it the intention that each tag has sway over their section of this site?

yes, need to add the codeowners to the root to allow them to merge themselves 👍

I'll add it on the TODO