DEV Community

#supplychainsecurity

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
RubyGems Supply Chain Vulnerability: What the OpenAI Bot Incident Teaches About Node.js and npm Security
rawas_aditya profile

RubyGems Supply Chain Vulnerability: What the OpenAI Bot Incident Teaches About Node.js and npm Security

#supplychainsecurity #npmvulnerabilities #packagemanagersecurity #rubygemscachingbug
Comments
7 min read
Supply Chain Security 2026: SBOM, Sigstore/SLSA, and Admission Control as DevOps Standard
saaro_net profile

Supply Chain Security 2026: SBOM, Sigstore/SLSA, and Admission Control as DevOps Standard

#devops #supplychainsecurity #sigstore #slsa
Comments
4 min read
Software Artifact Trust Starts At Package Registries
ceaz profile

Software Artifact Trust Starts At Package Registries

#supplychainsecurity #opensource #appsec #python
Comments
2 min read
No CVE Is Coming for Android-Image-Cropper. Audit Anyway.
secbyjasonmiller profile

No CVE Is Coming for Android-Image-Cropper. Audit Anyway.

#android #supplychainsecurity #sca #dependencyaudit
Comments
3 min read
Container Image Signing & SLSA Provenance Verification with Sigstore Cosign
aomiqaza profile

Container Image Signing & SLSA Provenance Verification with Sigstore Cosign

#supplychainsecurity #devops
Comments
4 min read
The LiteLLM compromise is not in any of the places you would look for it
mosiddi profile

The LiteLLM compromise is not in any of the places you would look for it

#supplychainsecurity #cicd #security #devops
Comments
4 min read
CNCF's shadow-AI post makes the case for treating agents as identities
leobaniak profile
Leo

CNCF's shadow-AI post makes the case for treating agents as identities

#shadowai #supplychainsecurity #cncf #kubernetes
Comments
3 min read
Omdia's 2026 supply-chain survey puts the annual-incident rate at 77 percent
leobaniak profile
Leo

Omdia's 2026 supply-chain survey puts the annual-incident rate at 77 percent

#supplychainsecurity #sbom #containers #cicdsecurity
1
Comments
2 min read
CISA's new OSS guidance puts a four-letter scoreboard next to every dependency you ship
leobaniak profile
Leo

CISA's new OSS guidance puts a four-letter scoreboard next to every dependency you ship

#cisa #supplychainsecurity #opensource #dependencies
Comments 1
3 min read
CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS
leobaniak profile
Leo

CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS

#sbom #cisa #supplychainsecurity #provenance
Comments
3 min read
npm walls off 2FA-bypass tokens from account and package management
leobaniak profile
Leo

npm walls off 2FA-bypass tokens from account and package management

#npm #supplychainsecurity #2fa #accesstokens
Comments
3 min read
Supply Chain Attacks verstehen: Praktische Tipps zur Abwehr von 2026
uhltak profile

Supply Chain Attacks verstehen: Praktische Tipps zur Abwehr von 2026

#supplychainsecurity #supplychainattacks #softwaredependencies #devsecops
Comments
6 min read
GTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams
leobaniak profile
Leo

GTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams

#supplychainsecurity #gtig #mandiant #cicdsecurity
Comments
4 min read
OpenAI open-sources the Codex Security CLI and keeps the scanner in-house
leobaniak profile
Leo

OpenAI open-sources the Codex Security CLI and keeps the scanner in-house

#openai #codex #supplychainsecurity #codescanning
Comments
4 min read
Docker's fourth horror story revisits the Nx post-install hook that drained CI secrets
leobaniak profile
Leo

Docker's fourth horror story revisits the Nx post-install hook that drained CI secrets

#supplychainsecurity #npm #postinstallhooks #cirunners
Comments
3 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.