Weekly Supply Chain Report

Worm-like supply chain attack on NPM: malicious code in 16 Namastex packages. Reported by Socket and StepSecurity; the attack targets SSH, K8s, LLM tokens and MetaMask/Phantom wallets, going cross-platform via PyPI.

In the same period, Lufthansa cancels 20,000 flights over the Iran war. The German carrier is cutting capacity to save 40,000 tonnes of jet fuel.

Elsewhere, India raises approved Russian ship insurers from 8 to 11. India's move preserves Russian tanker port access and keeps oil flowing.

Then, Red Sea ship ablaze, abandoned after Yemen-area attack. Crew rescued; vessel drifts in flames.

Continuing on, Greek-interest container ship hit by gunfire off Oman. Armed intervention in waters close to the Iranian coast.

Meanwhile, Houthis attack Netherlands-flagged ship in Gulf of Aden. Attack wave spreads to the southern Red Sea.

Shortly after, Jaguar Land Rover production paralysed by cyberattack. UK vehicle output down 27%; supplier network hit in cascade.

On another front, US cuts EU auto tariffs to 15%. Transatlantic trade deal terms firmed up.

In parallel, GSSA signs MoU with EARTH & LIFE SYMBIO on responsible supply chain governance. Signed at the WBCSD-Alibaba Green Supply Chain Forum during Shanghai Climate Week 2026, the MoU targets the green transformation of the global solar-storage value chain.

Around the same time, Med Beykoz container ship suffers engine failure in Çanakkale Strait. Tugs intervened to prevent traffic disruption; transits continued without delay.

In the same period, CENTCOM turns back 37 Iranian shadow-fleet vessels. US Central Command turned back 37 vessels including MV Sevan as sanctions enforcement intensifies.

Elsewhere, Akar Deniz acquires two chemical tankers from Maersk Tankers. Turkish operator picked up Bro Nuuk and Bro Nissum tankers from the Maersk Tankers fleet.

Then, Worker Galip Avcı killed at Aliağa ship recycling yard. Another worker died at Aliağa breaking yards; industry safety concerns mount.