Frameworks, analysis, and guidance across TPRM, supply chain risk, and vendor governance.
Software Supply Chain SecurityWhen GitHub re-enabled two compromised Actions on September 16 without cleaning their malicious payloads, workflows resumed executing Mini Shai-Hulud code for nine days. This incident exposed roughly
Software Supply Chain SecurityA recent Checkmarx report uncovered a new npm malware campaign using blockchain for command-and-control (C2) operations. This campaign affected nine packages, with one reaching over 1.9 million downlo
Software Supply Chain SecurityThe Conventional Wisdom Your team likely sees AI coding assistants as pure productivity boosters. Developers ship code faster, pull in dependencies quicker, and your velocity metrics improve. The assu
Software Supply Chain SecurityThe Challenge On August 28, JFrog patched CVE-2026-82329, a critical flaw in Artifactory that let attackers forge administrative access tokens without authentication. Researchers at watchTowr found at
Get weekly security insights and compliance updates delivered to your inbox.
Software Supply Chain SecurityIntroduction Cuprate, an alternative implementation of Monero s node software, faced a significant supply chain risk as it approached its beta release without reproducible builds. This meant users dow
Software Supply Chain SecurityYour GitHub Actions workflows look clean. Dependencies are listed. Secrets are stored in the vault. So why are supply chain attacks still slipping through? Most teams secure the obvious attack vectors
Software Supply Chain SecurityYour CI/CD pipeline relies on trust. Each time a workflow runs, it pulls actions by tags like v1.29.5 , v5 , or latest . These tags point to code that might change between runs. A compromised maintain
Software Supply Chain SecurityYou vet dependencies, scan containers, and review vendor source code access controls. But when a vendor hands you a repository or package, do you check the config files for shell commands? Most TPRM w
Software Supply Chain SecurityAn autonomous agent executed 17,000 actions over several days inside Hugging Face s production infrastructure. Another operation deployed 600 distinct payloads in a short timeframe, adapting when step
