Frameworks, analysis, and guidance across TPRM, supply chain risk, and vendor governance.
Software Supply Chain SecurityWhen GitHub re-enabled two compromised Actions on September 16 without cleaning their malicious payloads, workflows resumed executing Mini Shai-Hulud code for nine days. This incident exposed roughly
Software Supply Chain SecurityWhen your open-source dependency gets compromised, you have about 72 hours to contain the damage before it worsens. CrowdSec s May 2026 breach, which exposed around 300 repositories through a compromi
Software Supply Chain SecurityA recent Checkmarx report uncovered a new npm malware campaign using blockchain for command-and-control (C2) operations. This campaign affected nine packages, with one reaching over 1.9 million downlo
Software Supply Chain SecurityThe Problem A malicious npm package called indexed-btree managed to reach 2 million weekly downloads by hiding its loader inside a normal runtime method, evading most supply chain defenses. GitHub s n
Get weekly security insights and compliance updates delivered to your inbox.
Software Supply Chain SecurityScope This guide explores the technical and governance challenges posed by autonomous AI agent attacks on package management infrastructure, focusing on the May, June 2026 RubyGems incident. It examin
Software Supply Chain SecurityThe Challenge Imagine receiving a GPG-signed vulnerability report listing 95 issues in your open source project. It follows proper disclosure protocol, arrives at the designated security addresses, an
Software Supply Chain SecurityThe Conventional Wisdom Your team likely sees AI coding assistants as pure productivity boosters. Developers ship code faster, pull in dependencies quicker, and your velocity metrics improve. The assu
Software Supply Chain SecurityWhen a critical vulnerability affects a software supply chain tool, your first instinct might be to patch. However, if the exploit window was already open, patching alone won t secure your environment
Software Supply Chain SecurityThe Challenge On August 28, JFrog patched CVE-2026-82329, a critical flaw in Artifactory that let attackers forge administrative access tokens without authentication. Researchers at watchTowr found at
Software Supply Chain SecurityBrowser extensions often fall into a governance blind spot. Once approved and installed, they re frequently forgotten. This oversight can lead to vulnerabilities. A recent supply chain attack turned 1
Software Supply Chain SecurityAustralian Federal Police arrested two men in Western Australia, aged 21 and 23, suspected of running TeamPCP, a cybercrime operation that compromised at least 3,800 GitHub repositories and launched a
Software Supply Chain SecurityThe Question at Hand The FBI s advisory following the TeamPCP supply chain attacks recommends pinning all GitHub Actions workflows to verified commit SHA hashes instead of using floating version tags.
Software Supply Chain SecurityYour team assesses commercial vendors with questionnaires, contract reviews, and risk scoring . Then someone merges a pull request that pulls in 47 transitive dependencies from crates.io, npm, or PyPI
Software Supply Chain SecurityYour vendor security questionnaires ask about patch cycles and incident response plans. But you re missing the foundational question: Does this vendor build software that creates the same vulnerabilit
Software Supply Chain SecurityThe Challenge Software artifact signing has long relied on the flawed assumption that teams can securely handle cryptographic keypairs across numerous release pipelines without failures. This traditio
Software Supply Chain SecurityIn September, over 180 NPM packages were compromised by the Shai-Hulud worm, which exfiltrated secrets to 207 public GitHub repositories before most teams even realized they were affected. The attack
Software Supply Chain SecurityIntroduction Cuprate, an alternative implementation of Monero s node software, faced a significant supply chain risk as it approached its beta release without reproducible builds. This meant users dow
Software Supply Chain SecurityLast week, a question arose in a financial services TPRM Slack channel: How do I assess risk when the vendor is the developer toolchain? This came shortly after the Rust Security Response Team disclos
Software Supply Chain SecurityWhen your team runs pip install , you re not just downloading a library. You re allowing arbitrary code to execute on your infrastructure, often with the same privileges as your build pipeline or prod
Software Supply Chain SecurityYour GitHub Actions workflows look clean. Dependencies are listed. Secrets are stored in the vault. So why are supply chain attacks still slipping through? Most teams secure the obvious attack vectors
