6 articles tagged with Supply Chain.
A compromised npm release went after cloud credentials as expected, and local AI coding-assistant config files, which most teams never treated as secrets.
The keyv compromise reached 444 packages and over two billion monthly installs through preinstall scripts. The controls that actually stop it are boring and mostly free.
A practical tour of how software supply chain attacks reach your build, and the controls that actually stop them.
Your pipeline holds the keys to production and signs off on everything you ship, so harden both the pipeline itself and the artifacts it builds.
A practical look at how SCA scanning finds vulnerable dependencies, cuts CVE noise, and where SAST, DAST, and IAST fit into CI/CD.
SBOMs and signed attestations sound like checkboxes until you need to answer "did this artifact come from our pipeline?" The minimum viable supply-chain story we run.
