DEV Community

#supplychainsecurity

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
GitHub will block pull_request_target in public repos from December 2
leobaniak profile
Leo

GitHub will block pull_request_target in public repos from December 2

#githubactions #pullrequesttarget #supplychainsecurity #secrets
2
Comments
4 min read
When AI Agent adds Package, Who Approves That Dependency?
trivedi-khushi profile

When AI Agent adds Package, Who Approves That Dependency?

#cybersecurity #ai #supplychainsecurity #devsecops
Comments
5 min read
Fake font steals developer credentials
randomchaos profile
RC

Fake font steals developer credentials

#supplychainsecurity #githubactions #credentialstealer
Comments
3 min read
Fix Gradle Dependency Verification Failures
raylabs profile

Fix Gradle Dependency Verification Failures

#android #gradle #cicd #supplychainsecurity
Comments
5 min read
Keep the creepy crawlies out of you workflows: securing GitHub Actions in 2026
jessehouwing profile

Keep the creepy crawlies out of you workflows: securing GitHub Actions in 2026

#githubactions #supplychainsecurity #github
Comments
29 min read
A trusting-trust backdoor built from GNU strip
randomchaos profile
RC

A trusting-trust backdoor built from GNU strip

#trustingtrust #supplychainsecurity #nixos #reproduciblebuilds
Comments
3 min read
XZ Utils Backdoor: Die Lehren aus dem Beinahe-GAU fĂĽr Open Source
nova-reik profile

XZ Utils Backdoor: Die Lehren aus dem Beinahe-GAU fĂĽr Open Source

#cybersecurity #opensource #xzutils #supplychainsecurity
Comments
6 min read
RubyGems Supply Chain Vulnerability: What the OpenAI Bot Incident Teaches About Node.js and npm Security
rawas_aditya profile

RubyGems Supply Chain Vulnerability: What the OpenAI Bot Incident Teaches About Node.js and npm Security

#supplychainsecurity #npmvulnerabilities #packagemanagersecurity #rubygemscachingbug
Comments
7 min read
Supply Chain Security 2026: SBOM, Sigstore/SLSA, and Admission Control as DevOps Standard
saaro_net profile

Supply Chain Security 2026: SBOM, Sigstore/SLSA, and Admission Control as DevOps Standard

#devops #supplychainsecurity #sigstore #slsa
Comments
4 min read
No CVE Is Coming for Android-Image-Cropper. Audit Anyway.
secbyjasonmiller profile

No CVE Is Coming for Android-Image-Cropper. Audit Anyway.

#android #supplychainsecurity #sca #dependencyaudit
Comments
3 min read
What a Supply Chain Attack Is Really After: Your Credentials
dwayne_mcdaniel profile

What a Supply Chain Attack Is Really After: Your Credentials

#security #supplychainsecurity #devsecops #secrets
2
Comments
5 min read
Container Image Signing & SLSA Provenance Verification with Sigstore Cosign
aomiqaza profile

Container Image Signing & SLSA Provenance Verification with Sigstore Cosign

#supplychainsecurity #devops
Comments
4 min read
The LiteLLM compromise is not in any of the places you would look for it
mosiddi profile

The LiteLLM compromise is not in any of the places you would look for it

#supplychainsecurity #cicd #security #devops
Comments
4 min read
Software Artifact Trust Starts At Package Registries
ceaz profile

Software Artifact Trust Starts At Package Registries

#supplychainsecurity #opensource #appsec #python
Comments
2 min read
CNCF's shadow-AI post makes the case for treating agents as identities
leobaniak profile
Leo

CNCF's shadow-AI post makes the case for treating agents as identities

#shadowai #supplychainsecurity #cncf #kubernetes
Comments
3 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.