Frameworks, analysis, and guidance across TPRM, supply chain risk, and vendor governance.
Software Supply Chain SecurityA recent Checkmarx report uncovered a new npm malware campaign using blockchain for command-and-control (C2) operations. This campaign affected nine packages, with one reaching over 1.9 million downlo
Software Supply Chain SecurityThe Conventional Wisdom Your team likely sees AI coding assistants as pure productivity boosters. Developers ship code faster, pull in dependencies quicker, and your velocity metrics improve. The assu
Software Supply Chain SecurityThe Challenge On August 28, JFrog patched CVE-2026-82329, a critical flaw in Artifactory that let attackers forge administrative access tokens without authentication. Researchers at watchTowr found at
Software Supply Chain SecurityIntroduction Cuprate, an alternative implementation of Monero s node software, faced a significant supply chain risk as it approached its beta release without reproducible builds. This meant users dow
Get weekly security insights and compliance updates delivered to your inbox.
Software Supply Chain SecurityYour GitHub Actions workflows look clean. Dependencies are listed. Secrets are stored in the vault. So why are supply chain attacks still slipping through? Most teams secure the obvious attack vectors
Software Supply Chain SecurityYour CI/CD pipeline relies on trust. Each time a workflow runs, it pulls actions by tags like v1.29.5 , v5 , or latest . These tags point to code that might change between runs. A compromised maintain
Software Supply Chain SecurityYou vet dependencies, scan containers, and review vendor source code access controls. But when a vendor hands you a repository or package, do you check the config files for shell commands? Most TPRM w
