DEV Community

#supplychainsecurity

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Container Image Signing & SLSA Provenance Verification with Sigstore Cosign
aomiqaza profile

Container Image Signing & SLSA Provenance Verification with Sigstore Cosign

#supplychainsecurity #devops
Comments
4 min read
The LiteLLM compromise is not in any of the places you would look for it
mosiddi profile

The LiteLLM compromise is not in any of the places you would look for it

#supplychainsecurity #cicd #security #devops
Comments
4 min read
CNCF's shadow-AI post makes the case for treating agents as identities
leobaniak profile
Leo

CNCF's shadow-AI post makes the case for treating agents as identities

#shadowai #supplychainsecurity #cncf #kubernetes
Comments
3 min read
Omdia's 2026 supply-chain survey puts the annual-incident rate at 77 percent
leobaniak profile
Leo

Omdia's 2026 supply-chain survey puts the annual-incident rate at 77 percent

#supplychainsecurity #sbom #containers #cicdsecurity
1
Comments
2 min read
CISA's new OSS guidance puts a four-letter scoreboard next to every dependency you ship
leobaniak profile
Leo

CISA's new OSS guidance puts a four-letter scoreboard next to every dependency you ship

#cisa #supplychainsecurity #opensource #dependencies
Comments 1
3 min read
CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS
leobaniak profile
Leo

CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS

#sbom #cisa #supplychainsecurity #provenance
Comments
3 min read
npm walls off 2FA-bypass tokens from account and package management
leobaniak profile
Leo

npm walls off 2FA-bypass tokens from account and package management

#npm #supplychainsecurity #2fa #accesstokens
Comments
3 min read
Supply Chain Attacks verstehen: Praktische Tipps zur Abwehr von 2026
uhltak profile

Supply Chain Attacks verstehen: Praktische Tipps zur Abwehr von 2026

#supplychainsecurity #supplychainattacks #softwaredependencies #devsecops
Comments
6 min read
GTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams
leobaniak profile
Leo

GTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams

#supplychainsecurity #gtig #mandiant #cicdsecurity
Comments
4 min read
OpenAI open-sources the Codex Security CLI and keeps the scanner in-house
leobaniak profile
Leo

OpenAI open-sources the Codex Security CLI and keeps the scanner in-house

#openai #codex #supplychainsecurity #codescanning
Comments
4 min read
Docker's fourth horror story revisits the Nx post-install hook that drained CI secrets
leobaniak profile
Leo

Docker's fourth horror story revisits the Nx post-install hook that drained CI secrets

#supplychainsecurity #npm #postinstallhooks #cirunners
Comments
3 min read
GitHub Actions freezes suspected-malicious workflow runs until a human signs off
leobaniak profile
Leo

GitHub Actions freezes suspected-malicious workflow runs until a human signs off

#githubactions #supplychainsecurity #workflowapproval #cicdsecurity
Comments
4 min read
Dependabot's 3-Day Cooldown: Why Waiting Is Now Safer
induwara_ashinsana_9e4d5b profile

Dependabot's 3-Day Cooldown: Why Waiting Is Now Safer

#supplychainsecurity #dependabot #npm
Comments
4 min read
FakeGit floods GitHub with malicious repos aimed at coding agents
leobaniak profile
Leo

FakeGit floods GitHub with malicious repos aimed at coding agents

#supplychainsecurity #codingagents #github #malware
Comments
2 min read
The npm worm that shipped with valid SLSA provenance
leobaniak profile
Leo

The npm worm that shipped with valid SLSA provenance

#supplychainsecurity #slsa #provenance #npm
Comments
4 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.