DEV Community

#supplychainsecurity

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
A suspicious Git merge almost became a security incident.
suhag profile

A suspicious Git merge almost became a security incident.

#cybersecurity #githubsecurity #softwaredevelopment #supplychainsecurity
Comments
2 min read
Cooldown does not fix the resolver
randomchaos profile
RC

Cooldown does not fix the resolver

#rubygems #supplychainsecurity #bundler
Comments
4 min read
GitHub will block pull_request_target in public repos from December 2
leobaniak profile
Leo

GitHub will block pull_request_target in public repos from December 2

#githubactions #pullrequesttarget #supplychainsecurity #secrets
2
Comments
4 min read
When AI Agent adds Package, Who Approves That Dependency?
trivedi-khushi profile

When AI Agent adds Package, Who Approves That Dependency?

#cybersecurity #ai #supplychainsecurity #devsecops
Comments
5 min read
Fake font steals developer credentials
randomchaos profile
RC

Fake font steals developer credentials

#supplychainsecurity #githubactions #credentialstealer
Comments
3 min read
Fix Gradle Dependency Verification Failures
raylabs profile

Fix Gradle Dependency Verification Failures

#android #gradle #cicd #supplychainsecurity
Comments
5 min read
A trusting-trust backdoor built from GNU strip
randomchaos profile
RC

A trusting-trust backdoor built from GNU strip

#trustingtrust #supplychainsecurity #nixos #reproduciblebuilds
Comments
3 min read
XZ Utils Backdoor: Die Lehren aus dem Beinahe-GAU fĂĽr Open Source
nova-reik profile

XZ Utils Backdoor: Die Lehren aus dem Beinahe-GAU fĂĽr Open Source

#cybersecurity #opensource #xzutils #supplychainsecurity
Comments
6 min read
RubyGems Supply Chain Vulnerability: What the OpenAI Bot Incident Teaches About Node.js and npm Security
rawas_aditya profile

RubyGems Supply Chain Vulnerability: What the OpenAI Bot Incident Teaches About Node.js and npm Security

#supplychainsecurity #npmvulnerabilities #packagemanagersecurity #rubygemscachingbug
Comments
7 min read
Supply Chain Security 2026: SBOM, Sigstore/SLSA, and Admission Control as DevOps Standard
saaro_net profile

Supply Chain Security 2026: SBOM, Sigstore/SLSA, and Admission Control as DevOps Standard

#devops #supplychainsecurity #sigstore #slsa
Comments
4 min read
Keep the creepy crawlies out of you workflows: securing GitHub Actions in 2026
jessehouwing profile

Keep the creepy crawlies out of you workflows: securing GitHub Actions in 2026

#githubactions #supplychainsecurity #github
Comments 1
29 min read
No CVE Is Coming for Android-Image-Cropper. Audit Anyway.
secbyjasonmiller profile

No CVE Is Coming for Android-Image-Cropper. Audit Anyway.

#android #supplychainsecurity #sca #dependencyaudit
Comments
3 min read
What a Supply Chain Attack Is Really After: Your Credentials
dwayne_mcdaniel profile

What a Supply Chain Attack Is Really After: Your Credentials

#security #supplychainsecurity #devsecops #secrets
2
Comments
5 min read
Container Image Signing & SLSA Provenance Verification with Sigstore Cosign
aomiqaza profile

Container Image Signing & SLSA Provenance Verification with Sigstore Cosign

#supplychainsecurity #devops
Comments
4 min read
Software Artifact Trust Starts At Package Registries
ceaz profile

Software Artifact Trust Starts At Package Registries

#supplychainsecurity #opensource #appsec #python
Comments
2 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.