17 stories tagged supply-chain-security, newest first.
44 points by acossta | 0 comments
Wiz Research blog post analyzing Gheist, a campaign using stolen GitHub tokens to plant workflows that dump repository secrets, with IOCs and response guidance.
6 points by soheilpro | 0 comments
GitHub changelog post announcing the public preview of GitHub package firewall, a feature for protecting against malicious or risky package dependencies.
43 points by datosh | 1 comments
A blog post on using VEX (Vulnerability Exploitability eXchange) documents to manage vulnerability reports in NixOS.
9 points by codyznash | 1 comments
A Manifold research blog post examining how language models fall back on moral reasoning when asked whether code packages like PyPI libraries are malicious.
139 points by mixedbit | 48 comments
Project homepage for Drop, a rootless Linux sandbox using namespaces and optional gVisor to isolate programs and coding agents in a familiar environment.
494 points by gregnavis | 398 comments
Blog post by Aaron Patterson (tenderlove) about reports that OpenAI agents exploited a RubyGems.org caching vulnerability and ran scraping code on RubyDoc.info.
484 points by mooreds | 82 comments
Andrew Nesbitt's satirical incident report about a malicious package slipping past seven AI-powered security gates in a fictional future CVE.
344 points by vinhnx | 95 comments
Astral blog post by William Woodruff describing the techniques Astral uses to secure its open source tools and their build, test, and release processes against supply chain attacks.
606 points by todsacerdoti | 178 comments
Filippo Valsorda's blog post arguing that Dependabot is a noise machine and should be turned off, especially for security alerts in the Go ecosystem.
336 points by anttiharju | 79 comments
Docker blog post announcing that Docker Hardened Images, security-focused minimal container base images, are now freely available to all developers.
408 points by robin_reala | 236 comments
Andrew Nesbitt's blog post arguing GitHub Actions functions as a package manager lacking lockfiles, integrity hashes, and other supply chain safeguards.
460 points by todsacerdoti | 259 comments
Blog post arguing that dependency cooldowns, via tools like Dependabot and Renovate, are a cheap, effective way to mitigate most open source supply chain attacks.
657 points by spiridow | 219 comments
Kudelski Security research post describing how a pull request to CodeRabbit led to remote code execution and write access to about one million repositories.
778 points by zdw | 160 comments
Trail of Bits blog post describing its security audit of Homebrew's brew CLI and related repositories, written jointly with the Homebrew maintainers.
468 points by transpute | 267 comments
Rob Mensching blog post, adapted from a Twitter thread, reflecting on the xz/liblzma backdoor as a microcosm of interactions in open source projects.
714 points by ben_s | 269 comments
GitHub repository for Under New Management, a Chrome extension that detects when installed Chrome extensions have changed owners.
515 points by CathalMullan | 159 comments
NixOS Discourse announcement that the nixos-minimal installation ISO built by Hydra was independently rebuilt bit-for-bit identically, verifying reproducibility.