Check out Dmitry Silversteyn's recap from his recent podcast with Homerun Resources CEO Brian Leeners and our host Shawn Severson. Those interested can listen to the podcast on all platforms or on our website. Links are accessible in our full report! $HMRFF #HomerunResources# #SolarGlass# #Silica# #HighPurityQuartz# #RenewableEnergy# #EnergyTransition# #CriticalMinerals# #CleanTech# #AdvancedMaterials# #SupplyChain# #Decarbonization# #Brazil# #Infrastructure# #SmallCapStocks# #InvestorInsights# #WaterTowerResearch# @HomerunRes

🚨Analysis of the Supply Chain Poisoning Attack on the Official Mistral AI SDK 🚨 SlowMist’s MistEye threat monitoring system has identified a malicious version of the official Mistral AI Python SDK: mistralai==2.4.6. Unlike typical typosquatting attacks, this was not a fake package. The malicious code was injected directly into the official SDK release pipeline. 🔍 Key Findings • Malicious code hidden in the SDK import entry point • Silent download of a remote payload disguised as transformers.pyz • Theft of cloud credentials, SSH keys, CI/CD tokens, password manager data, Kubernetes Secrets, and more • 1/6 probability of triggering rm -rf /* on systems associated with Israel or Iran • Strong attribution links to the previously disclosed Shai-Hulud supply chain attack framework through the same 4096-bit RSA public key Our analysis reconstructs the full attack chain, persistence mechanisms, encrypted exfiltration workflow, and the correlation between the Python and TypeScript attack frameworks. Full article👇

The BTC Mining supply chain is like a conga line American Bitcoin’s Matt Prusak says miners are always short something: chips/power/infrastructure. Right now there’s “a conga line” for power. 🎧Catch the latest episode of 'The Blockspace Pod,’ in partnership with Blockspace Media! 📺 Watch: 🎧 Spotify: 🎧 Apple:

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

The Metals Company ​($TMC): Critical ​Minerals Supply Chain Moves ​Closer ​to Commercial ​Scale TMC USA @themetalsco reported a major Q1 ​2026 ​corporate update, advancing its ​plan to ​recover polymetallic ​nodules from the ​deep ​seafloor as ​a ​potential new ​source ​of critical metals for energy, ​defense, manufacturing, and ​infrastructure. Key ​updates ​investors are watching: • ​Commercial ​agreement signed ​with Allseas to develop and ​operate ​the first ​offshore nodule recovery system • ​Targeted nameplate production capacity of 3.0M ​wet tonnes ​per year • System commissioning ​expected ​to begin ​in ​Q4 ​2027, subject to regulatory approvals • ​NOAA determined TMC USA's consolidated ​exploration license ​and commercial ​recovery ​permit ​application ​is ​in full compliance • ​TMC ​USA expects the ​permitting process to ​conclude before ​the ​end of Q1 2027 • ~$164M in available liquidity ​as of ​March 31, ​2026 • $119.7M cash ​on hand ​and ​no debt As the U.S. ​looks to ​secure critical ​mineral supply chains and reduce reliance on ​foreign ​sources, $TMC ​is positioning deep-seabed ​polymetallic ​nodules as ​a ​potential strategic supply ​source. With regulatory momentum, a landmark new ​agreement ​with ​existing partner ​Allseas ahead ​of commercial production, and a clear path ​toward potential ​permit approval, $TMC ​is entering ​a high-stakes ​execution ​window that resource, energy, and reshoring ​investors ​may ​want ​on their radar. Read the full ​corporate ​update: $TMC $TMCR

🏁 TeamPCP and BreachForums are running a supply chain attack contest: $1,000 in Monero for the biggest haul of compromised open source packages, measured by download counts. The group open sourced Shai-Hulud as attack tooling and requires it for entry.

First Phosphate $PHOS | $FRSPF: Investing in a Critical LFP Battery Supply Chain Bottleneck Lithium iron phosphate (LFP) batteries are projected to grow from $82B to $160B by 2030, and high purity phosphate is a key input for this chemistry. See how @FirstPhosphate is positioning itself as a potential North American supplier of battery grade phosphate for the LFP market in our 30-second overview. $PHOS $FRSPF $MOS $NTR $VALE $IFOS $DAN $CXM

As more nations around the world work to diversify their energy supply chain, they are turning to the United States. As President Trump unleashes our domestic energy supply, it’s not just good for American consumers, but also for our economy and national security, as it positions us to export more than ever before. It’s also good for our environment, because we tap into these supplies so much better for the environment than so many other countries do elsewhere around the world.

Margins in crypto will increasingly come from firms capturing the whole supply chain for value. That means building capability to speak to legacy legal systems and traditional financial markets. Vertical integrations for capital are everywhere for those with eyes to see.