DEV Community

#supplychain

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
uv audit vs pip-audit, and a gate narrower than it looks
curioustore_48788631d0e2e profile

uv audit vs pip-audit, and a gate narrower than it looks

#python #security #devops #supplychain
5
Comments
13 min read
GhostApproval: six AI coding agents shipped a permission dialog that was reading the wrong path
leobaniak profile
Leo

GhostApproval: six AI coding agents shipped a permission dialog that was reading the wrong path

#aiagents #codingagents #supplychain #security
Comments
4 min read
setup-java 5.5.0 adds JDK signature verification, if you remember to enable it
leobaniak profile
Leo

setup-java 5.5.0 adds JDK signature verification, if you remember to enable it

#githubactions #java #signing #supplychain
Comments
3 min read
npm v12 flips install-time to closed-by-default
leobaniak profile
Leo

npm v12 flips install-time to closed-by-default

#npm #supplychain #security #2fa
Comments
3 min read
PolinRider keeps expanding, and the postinstall still lands on your runner
leobaniak profile
Leo

PolinRider keeps expanding, and the postinstall still lands on your runner

#supplychain #security #npm #maliciouspackages
Comments
3 min read
The SBOM you can trust is the one your build actually made
leobaniak profile
Leo

The SBOM you can trust is the one your build actually made

#sbom #supplychain #docker #buildkit
Comments
4 min read
From vexctl scripts to a governed VEX platform: building vex-ui with Next.js, keyless signing, and a Trivy-consumable repo
darkedges profile

From vexctl scripts to a governed VEX platform: building vex-ui with Next.js, keyless signing, and a Trivy-consumable repo

#security #nextjs #devops #supplychain
Comments
5 min read
MCP supply chain attacks are coming — here's how to prepare
edison_flores_6d2cd381b13 profile

MCP supply chain attacks are coming — here's how to prepare

#mcp #security #supplychain #npm
Comments
2 min read
GitHub starts watching the whole public site for your leaked secrets
leobaniak profile
Leo

GitHub starts watching the whole public site for your leaked secrets

#github #secretscanning #supplychain #enterprise
Comments
4 min read
Cordyceps and the pipeline attack surface we keep ignoring
leobaniak profile
Leo

Cordyceps and the pipeline attack surface we keep ignoring

#cicdsecurity #supplychain #runners #vulnerability
Comments
3 min read
Why MLCC Lead Times Are Blowing Up in 2026 (And How to Design Around It)
lucas_ding profile

Why MLCC Lead Times Are Blowing Up in 2026 (And How to Design Around It)

#electronics #hardware #pcb #supplychain
Comments
3 min read
Aikido buys Root to patch open source in place, without the upgrade dance
leobaniak profile
Leo

Aikido buys Root to patch open source in place, without the upgrade dance

#supplychain #cve #dependencies #security
Comments
4 min read
The Supply Chain Attack Vector Everyone Is Ignoring in AI Agents
szybnev profile

The Supply Chain Attack Vector Everyone Is Ignoring in AI Agents

#ai #programming #supplychain #attack
Comments
3 min read
GitHub Actions hands fork triggers a read-only cache token
leobaniak profile
Leo

GitHub Actions hands fork triggers a read-only cache token

#githubactions #cache #supplychain #leastprivilege
Comments
4 min read
CI is the wrong place to first hear about your npm dependencies
leobaniak profile
Leo

CI is the wrong place to first hear about your npm dependencies

#supplychain #shiftleft #node #npm
Comments
3 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.