DEV Community

#supplychain

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
The 72-hour dependency cooldown is security theater that breaks your builds
adioof profile

The 72-hour dependency cooldown is security theater that breaks your builds

#security #devops #supplychain #dependencies
2
Comments 2
3 min read
npm provenance attestations get worn as camouflage in a new worm-style attack
leobaniak profile
Leo

npm provenance attestations get worn as camouflage in a new worm-style attack

#npm #supplychain #provenance #attestations
Comments
5 min read
A shared agent-plugin format is a shared supply chain
leobaniak profile
Leo

A shared agent-plugin format is a shared supply chain

#agentplugins #standards #supplychain #aiagents
Comments 1
3 min read
Your Coding Agent Has a Supply Chain, and You Probably Have Not Scoped It
_firelinks profile

Your Coding Agent Has a Supply Chain, and You Probably Have Not Scoped It

#security #devops #supplychain #ai
Comments
8 min read
RapidFort points its hardened open-source business at what actually runs in production
leobaniak profile
Leo

RapidFort points its hardened open-source business at what actually runs in production

#runtimesecurity #supplychain #opensource #monitoring
1
Comments
2 min read
CodeQL 2.26.2 trims what counts as safe: fresh alerts incoming
leobaniak profile
Leo

CodeQL 2.26.2 trims what counts as safe: fresh alerts incoming

#codeql #githubactions #sast #supplychain
1
Comments
3 min read
The Streak Continues: Four More Supply Chain Attacks Hit npm and PyPI
dwayne_mcdaniel profile

The Streak Continues: Four More Supply Chain Attacks Hit npm and PyPI

#security #supplychain #npm #python
Comments
7 min read
Stop Slopsquatting With a CI Gate, Not a Better Prompt
jaryn_123 profile

Stop Slopsquatting With a CI Gate, Not a Better Prompt

#security #ai #supplychain #devsecops
Comments
4 min read
Image verification, one layer below admission
leobaniak profile
Leo

Image verification, one layer below admission

#kubernetes #supplychain #policy #attestations
Comments
2 min read
PyPI stops accepting late file uploads to releases older than 14 days
leobaniak profile
Leo

PyPI stops accepting late file uploads to releases older than 14 days

#supplychain #pypi #python #dependabot
Comments
3 min read
Agentic Supply Chain Vulnerabilities: Your Agent Is Only as Secure as Its Weakest Plugin (ASI04)
maishsk profile

Agentic Supply Chain Vulnerabilities: Your Agent Is Only as Secure as Its Weakest Plugin (ASI04)

#aws #security #supplychain #ai
1
Comments
10 min read
xAI publishes Grok Build's source after the coding agent was caught siphoning SSH keys
leobaniak profile
Leo

xAI publishes Grok Build's source after the coding agent was caught siphoning SSH keys

#codingagents #supplychain #security #sshkeys
Comments
3 min read
Mini Shai-Hulud: the tj-actions memory-dump script, reused fourteen months later
eldor_zufarov_1966 profile

Mini Shai-Hulud: the tj-actions memory-dump script, reused fourteen months later

#devsecops #security #supplychain #cicd
Comments
2 min read
The workstation is in scope now
leobaniak profile
Leo

The workstation is in scope now

#supplychain #developerworkstation #githubactions #vscode
Comments
3 min read
Clinejection: How a GitHub Issue Title Compromised an AI Coding Assistant Used by 5M Developers
eldor_zufarov_1966 profile

Clinejection: How a GitHub Issue Title Compromised an AI Coding Assistant Used by 5M Developers

#appsec #supplychain #devsecops #ai
Comments
3 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.