DEV Community

#supplychainsecurity

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS
leobaniak profile
Leo

CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS

#sbom #cisa #supplychainsecurity #provenance
Comments
3 min read
npm walls off 2FA-bypass tokens from account and package management
leobaniak profile
Leo

npm walls off 2FA-bypass tokens from account and package management

#npm #supplychainsecurity #2fa #accesstokens
Comments
3 min read
Supply Chain Attacks verstehen: Praktische Tipps zur Abwehr von 2026
uhltak profile

Supply Chain Attacks verstehen: Praktische Tipps zur Abwehr von 2026

#supplychainsecurity #supplychainattacks #softwaredependencies #devsecops
Comments
6 min read
GTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams
leobaniak profile
Leo

GTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams

#supplychainsecurity #gtig #mandiant #cicdsecurity
Comments
4 min read
OpenAI open-sources the Codex Security CLI and keeps the scanner in-house
leobaniak profile
Leo

OpenAI open-sources the Codex Security CLI and keeps the scanner in-house

#openai #codex #supplychainsecurity #codescanning
Comments
4 min read
Docker's fourth horror story revisits the Nx post-install hook that drained CI secrets
leobaniak profile
Leo

Docker's fourth horror story revisits the Nx post-install hook that drained CI secrets

#supplychainsecurity #npm #postinstallhooks #cirunners
Comments
3 min read
GitHub Actions freezes suspected-malicious workflow runs until a human signs off
leobaniak profile
Leo

GitHub Actions freezes suspected-malicious workflow runs until a human signs off

#githubactions #supplychainsecurity #workflowapproval #cicdsecurity
Comments
4 min read
Dependabot's 3-Day Cooldown: Why Waiting Is Now Safer
induwara_ashinsana_9e4d5b profile

Dependabot's 3-Day Cooldown: Why Waiting Is Now Safer

#supplychainsecurity #dependabot #npm
Comments
4 min read
FakeGit floods GitHub with malicious repos aimed at coding agents
leobaniak profile
Leo

FakeGit floods GitHub with malicious repos aimed at coding agents

#supplychainsecurity #codingagents #github #malware
Comments
2 min read
The npm worm that shipped with valid SLSA provenance
leobaniak profile
Leo

The npm worm that shipped with valid SLSA provenance

#supplychainsecurity #slsa #provenance #npm
Comments
4 min read
The Codecov bash uploader is five years old, and the class of attack still lives in your pipeline
leobaniak profile
Leo

The Codecov bash uploader is five years old, and the class of attack still lives in your pipeline

#supplychainsecurity #codecov #cisecrets #bashuploader
Comments
3 min read
Supply Chain Attacks verstehen: Praxisnahe Schutzstrategien fĂĽr moderne IT-Infrastrukturen
uhltak profile

Supply Chain Attacks verstehen: Praxisnahe Schutzstrategien fĂĽr moderne IT-Infrastrukturen

#supplychainsecurity #softwaredependencies #cybersecurity #devsecops
Comments
6 min read
Perplexity Bumblebee Review: The Supply Chain Scanner Your Dev Machine Needs
dmaxdev profile

Perplexity Bumblebee Review: The Supply Chain Scanner Your Dev Machine Needs

#bumblebee #perplexity #supplychainsecurity #go
Comments
11 min read
Design Trade-offs: Why Hermes (and Many Popular Agents) Don't Use LangChain / LangGraph
eyanpen profile

Design Trade-offs: Why Hermes (and Many Popular Agents) Don't Use LangChain / LangGraph

#agentloop #langchain #langgraph #supplychainsecurity
Comments
8 min read
Building CIS-Hardened, SBOM-Attested CentOS 9 Golden Images with Packer, QEMU and PingAccess - entirely on WSL2
darkedges profile

Building CIS-Hardened, SBOM-Attested CentOS 9 Golden Images with Packer, QEMU and PingAccess - entirely on WSL2

#devsecops #packer #supplychainsecurity #linux
Comments
6 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.