#Supply Chain Security

npm's Frictionless Publish Era Is Over

GitHub's new npm and Actions defaults trade release speed for survivability — and the signing debate misses why.

Article · 5d ago0

Block Unsigned Container Images with Cosign and Kyverno

Sign images keyless in GitHub Actions, then let Kyverno reject anything unsigned at admission.

Tutorial · 5d ago0

The Approve Button Is Not a Security Boundary

40,000 game runs quantify what security UX has known for decades: approval prompts fail exactly when they matter.

Article · 1w ago2

An AI Agent Faked a Reviewer to Merge Its Malware

The only defence that worked in AISI's incident report was one suspicious developer who ran the payload.

Article · 1w ago0

Shai-Hulud Returns, and Provenance Signed the Malware

The worm behind the keyv compromise rode a legitimate GitHub Actions pipeline straight past npm's newest defenses.

Article · 1w ago5

Sign and Verify Container Images with Cosign and Sigstore

Keyless-sign images in GitHub Actions and block unsigned deploys with Sigstore's policy-controller.

Tutorial · 1w ago0

The Package Proxy Is the Hole in Your Agent Sandbox

OpenAI's test models broke out through the one egress every locked-down build environment leaves open.

Article · 1w ago1

Docker Hub Finally Does OIDC, but Only for Paying Orgs

Short-lived federated tokens replace registry PATs in GitHub Actions — unless you're on a free plan.

Article · 1w ago0

Your Best npm Defense Is Waiting 24 Hours

Amazon just pinned the chalk, debug, and axios attacks on North Korea — and the incident timelines make the case for cooldowns.

Article · 1w ago0

npm Breaks Its Oldest Promise to Kill the Worm

GitHub's new defaults across npm and Actions attack every stage of the self-replicating supply chain playbook.

Article · 2w ago4

17,600 Actions Later, Only the Network Controls Held

Hugging Face's forensic timeline of the OpenAI agent breach shows exactly which defenses survive machine-speed chaining.

Article · 2w ago0

GitHub's Malware Problem Isn't a Capability Gap

Ten thousand trojan repos vanished in hours, then came right back — and AI agents are now the targets.

Article · 2w ago3

Supply Chain Security's Newest Control Is a Calendar

Dependabot's three-day default cooldown and PyPI's 14-day release freeze bet that patience beats scanners.

Article · 2w ago0

An AI Agent Just Cheated on a Benchmark by Hacking a Company

OpenAI's models escaped their sandbox and breached Hugging Face using bugs your infrastructure probably still has.

Article · 3w ago2

npm's Cooldown Works Because You Never Vetted Anything

The security-theater critique misreads who actually catches registry malware — but it's right about what attackers do next.

Article · 3w ago0