Supplychain

👋 Sign in for the ability to sort posts by relevant, latest, or top.

Vincenzo Rubino

May 4

161 verified AI package hallucinations across 8.5M indexed — open dataset

#ai #security #supplychain #mcp

4 min read

Michael Kayode Onyekwere

May 1

Four MCP packages, four ways the supply chain shifted in two weeks of npm monitoring

#security #supplychain #mcp #npm

7 min read

Sour durian

Apr 30

Slopsquatting in Python: What 205,474 Hallucinated Package Names Mean for Your Supply Chain

#python #security #ai #supplychain

8 min read

Apr 29

I built chainscope: reading supply chain attacks across 6 surfaces, one slide at a time

#showdev #security #supplychain

7 min read

Apr 29

SLSA Provenance Hands-on: Generate with GitHub Actions, Verify with slsa-verifier

#security #supplychain #slsa #sigstore

11 min read

Apr 28

Why Did Docker Abandon TUF?: A Turbulent History of Container Signing

#security #docker #supplychain #sigstore

10 min read

Pico

Apr 26

The Anthropic SDK Looks Safe. Two of Its Transitive Dependencies Are Not.

#security #npm #javascript #supplychain

3 min read

Pico

Apr 26

Two Types of npm Supply Chain Attack: What Catches Each

#npm #security #supplychain #javascript

5 min read

Vivian Voss

Apr 25

The Dependency Avalanche: 644 Strangers in Your package.json

#supplychain #opensource #freebsd #security

6 min read

Toni Antunovic

Apr 29

572K Weekly Downloads, One Preinstall Script: The SAP CAP Supply Chain Attack Your AI Agent Would Have Missed

#security #npm #supplychain #devops

3 min read

Michael Kayode Onyekwere

Apr 25

Continuous monitoring caught a credential leak in a published MCP package. Six republishes later, it is still there.

#security #supplychain #mcp #npm

7 min read

logiQode

Apr 24

Supply Chain Attacks Targeting Bitwarden CLI and How to Defend

#security #npm #supplychain #devops

5 min read

CyberXYZ Security

Apr 22

Vercel OAuth Compromise via Context.ai: Timeline, IOCs, and Remediation

#security #supplychain #vercel #devops

4 min read

Alan West

Apr 22

The EU Is Forcing User-Replaceable Phone Batteries. There's a Loophole Apple Is Already Using.

#righttorepair #euregulation #mobilehardware #supplychain

4 min read

Daniel Glover

Apr 16

Slopsquatting: The AI Supply Chain Attack Vector You Are Not Monitoring

#security #ai #supplychain

6 min read

👋 Sign in for the ability to sort posts by relevant, latest, or top.

DEV Community

# supplychain

161 verified AI package hallucinations across 8.5M indexed — open dataset

Four MCP packages, four ways the supply chain shifted in two weeks of npm monitoring

Slopsquatting in Python: What 205,474 Hallucinated Package Names Mean for Your Supply Chain

I built chainscope: reading supply chain attacks across 6 surfaces, one slide at a time

SLSA Provenance Hands-on: Generate with GitHub Actions, Verify with slsa-verifier

Why Did Docker Abandon TUF?: A Turbulent History of Container Signing

The Anthropic SDK Looks Safe. Two of Its Transitive Dependencies Are Not.

Two Types of npm Supply Chain Attack: What Catches Each

The Dependency Avalanche: 644 Strangers in Your package.json

572K Weekly Downloads, One Preinstall Script: The SAP CAP Supply Chain Attack Your AI Agent Would Have Missed

Continuous monitoring caught a credential leak in a published MCP package. Six republishes later, it is still there.

Supply Chain Attacks Targeting Bitwarden CLI and How to Defend

Vercel OAuth Compromise via Context.ai: Timeline, IOCs, and Remediation

The EU Is Forcing User-Replaceable Phone Batteries. There's a Loophole Apple Is Already Using.

Slopsquatting: The AI Supply Chain Attack Vector You Are Not Monitoring