# sbom Published articles for sbom. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Prepare for the Cyber Resilience Act's 24-hour reporting deadline DevFeed: [Prepare for the Cyber Resilience Act's 24-hour reporting deadline]() Original publisher: [Read original article]() Author: Amit Shalem Published: 2026-09-10T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [Vulnerabilities](), [open-source-security](), [Incident response]() Tags: [compliance](), [cybersecurity](), [europe](), [features](), [sbom](), [security](), [supply-chain](), [supply-chain-security](), [vulnerabilities]() ### AI overview The article explains the Cyber Resilience Act requirement for manufacturers to report actively exploited product vulnerabilities within 24 hours of becoming aware of them. It presents continuous software supply-chain detection, dependency scanning, SBOM monitoring, KEV status, EPSS scores, and container scanning as ways GitLab can help organizations identify and prioritize reportable risks. ### Source excerpt Starting on September 11, 2026, many businesses that place software on the European Union (EU) market will have 24 hours to file a report once they learn that a vulnerability in one of their products is being actively exploited. This is a new requirement under the Cyber Resilience Act (CRA), the EU law that sets cybersecurity requirements for products with digital elements sold in Europe, put in place to ensure those products are secure by design and supported against new threats. The most stringent requirements under the CRA apply to the manufacturers that make those products, from large software vendors to companies shipping connected hardware. The challenge a business faces to stay compliant is not the filing itself. It is finding out fast enough that a vulnerability in something you shipped is being actively exploited in your software supply chain. The 24-hour clock starts the moment you become aware, this is why detection is so important. Continuous detection is an engineering solution rather than a one-off compliance one. GitLab's software supply chain security capabilities are built to help you find active exploitation in what you shipped, automatically and continuously. This article walks through four questions you should ask yourself about your own pipeline's continuous detection solution today. Reporting requirement starts in September 2026 Beginning September 11, 2026, manufacturers have to report an actively exploited vulnerability within 24 hours of becoming aware of it. The reporting runs in three stages each submitted simultaneously to the European Union Agency for Cybersecurity (ENISA) and to the Computer Security Incident Response Team (CSIRT) designated as coordinator. Early warning, within 24 hours of becoming aware of the actively exploited vulnerability. A short first alert that exploitation is happening. You are not expected to know the full scope of impact or the fix yet. Notification, within 72 hours. A fuller account, covering what is affect ## What it took to reach 1 billion build manifests DevFeed: [What it took to reach 1 billion build manifests]() Original publisher: [Read original article]() Published: 2026-09-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [container images](), [chainguard os](), [supply-chain-security](), [sigstore](), [Linux](), [NumPy]() Tags: [chainguard](), [chainguard-factory](), [chainguard-os](), [container-images](), [go](), [open-source](), [provenance](), [sbom](), [sigstore](), [software-supply-chain]() ### AI overview Chainguard describes how it doubled container build output from 500 million to more than 1 billion manifests in six months. The article explains how Chainguard Factory and Chainguard OS support continuous rebuilds, while using source builds, SLSA Level 3 provenance, Sigstore signatures, and full SBOMs. ### Source excerpt Chainguard doubled its container build output in six months. Learn how Factory 2.0 uses AI and reconciliation to rebuild secure software at scale. ## Proven, not promised: Chainguard Containers achieves SLSA Build Level 3 DevFeed: [Proven, not promised: Chainguard Containers achieves SLSA Build Level 3]() Original publisher: [Read original article]() Published: 2026-08-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [supply-chain-security](), [software bill of materials](), [Security]() Tags: [chainguard](), [chainguard-containers](), [provenance](), [sbom](), [security](), [signing](), [slsa](), [software-supply-chain-security](), [supply-chain]() ### AI overview Chainguard says Coalfire independently assessed the Chainguard Containers build and release system as meeting SLSA Build Level 3 requirements. The article describes hardened, isolated builds, separately managed signing, provenance generation, and signed SBOMs for releases. ### Source excerpt Coalfire independently assessed Chainguard Containers at SLSA Build Level 3, validating hardened builds, provenance, and supply chain integrity. ## What's New in vcpkg (Jul 2026) DevFeed: [What's New in vcpkg (Jul 2026)]() Original publisher: [Read original article]() Author: Augustin Popa Published: 2026-08-11T22:43:41Z Content type: release Language: en Sources: [C++ Team Blog]() Topics: [releases](), [C++]() Tags: [bug](), [c-plus-plus](), [changelog](), [releases](), [sbom](), [supply-chain](), [vcpkg]() ### AI overview The July 2026 vcpkg release adds SBOM metadata improvements, updates 302 ports, and includes deployment, compatibility, robustness, documentation, and bug-fix changes. ### Source excerpt These updates include major SBOM improvements in vcpkg-tool, 302 updated ports including multiple major library upgrades, and other minor improvements and bug fixes. The post What's New in vcpkg (Jul 2026) appeared first on C++ Team Blog. ## A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope DevFeed: [A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope]() Original publisher: [Read original article]() Author: Liran Tal; Marian Corneci Published: 2026-06-16T21:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [awareness](), [blog](), [ci-cd](), [cross-platform](), [cryptocurrency](), [developer](), [devops](), [devrel](), [devsecops](), [incident](), [javascript](), [node-js](), [open-source-security](), [payload](), [persistence](), [remote-access-trojan](), [sbom](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [tls](), [vulnerability-insights]() ### AI overview A dormant former-contributor npm account was compromised and used to republish the Mastra package scope with a malicious dependency that installs cryptocurrency-stealing malware and a persistent remote-access trojan. The article describes the stale access control that enabled the supply-chain incident and advises treating affected installations as credential and wallet exposure events. ### Source excerpt A dormant contributor account was used to republish the entire @mastra npm scope, each injected with a single dependency, easy-day-js, that drops a cross-platform cryptocurrency stealer. Here is how the attack worked, how to check exposure, and how to remediate. ## Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages DevFeed: [Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages]() Original publisher: [Read original article]() Author: Brian Clark Published: 2026-06-01T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Malware](), [npm packages](), [redhat](), [incident](), [GitHub](), [OpenID connect (OIDC)](), [API](), [React](), [Cloud]() Tags: [api](), [article](), [awareness](), [ci-cd](), [cloud-security](), [developer](), [devops](), [devsecops](), [enablement](), [github](), [incident](), [interest](), [npm-packages](), [oidc](), [payload](), [react](), [redhat](), [sbom](), [scm](), [scope](), [secrets](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview The Miasma supply chain attack compromised at least 32 @redhat-cloud-services npm package releases used by the Red Hat Hybrid Cloud Console. The malicious installation script steals developer and cloud credentials, attempts to spread through packages victims can publish, and may expose secrets on affected workstations and CI runners. ### Source excerpt A supply chain worm dubbed Miasma has been found in dozens of @redhat-cloud-services npm releases. The malicious preinstall hook steals credentials, probes cloud identities, and can republish other packages. ## TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack DevFeed: [TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-05-11T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [article](), [attacks](), [cache](), [ci-cd](), [cryptographic](), [developer](), [devops](), [devsecops](), [github](), [github-actions](), [identity](), [incident](), [maintainers](), [memory](), [npm-packages](), [open-source-security](), [sbom](), [scm](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [teampcp](), [tech](), [toolchain](), [vulnerability-insights](), [workflow]() ### AI overview TanStack's legitimate release pipeline was hijacked to publish malicious npm packages with valid SLSA provenance. The article describes the Mini Shai-Hulud supply-chain attack, its impact, and remediation guidance to rotate secrets on affected install environments. ### Source excerpt On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory -- producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now. ## lightning PyPI Compromise: A Bun-Based Credential Stealer in Python DevFeed: [lightning PyPI Compromise: A Bun-Based Credential Stealer in Python]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-04-30T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Malware](), [Python](), [Bun](), [JavaScript](), [GitHub](), [snyk-learn](), [npm](), [releases]() Tags: [article](), [awareness](), [ci-cd](), [code](), [developer](), [devops](), [github](), [javascript](), [open-source-security](), [payload](), [python](), [release](), [sbom](), [secrets](), [security](), [security-labs](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview A compromised lightning PyPI release downloads the Bun JavaScript runtime at import time and executes an approximately 11 MB obfuscated credential stealer. The article covers the package compromise, Snyk advisory, remediation, and similarities to the preceding Mini Shai-Hulud npm campaign. ### Source excerpt A malicious release of the lightning PyPI package ships a credential-stealing Bun payload that runs on import. Snyk has a live advisory. Here's what's in the package, what to rotate, and how the payload pattern connects to the Mini Shai-Hulud npm campaign one day earlier. ## JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up? DevFeed: [JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?]() Original publisher: [Read original article]() Author: John Carione Published: 2026-04-23T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Resilience](), [Security](), [snyk-iac](), [supply-chain-security](), [vulnerability](), [Infrastructure as code](), [Open Source](), [AI Development](), [releases](), [pull-requests](), [Code]() Tags: [ai](), [ai-development](), [awareness](), [blog](), [cloud-security](), [code](), [contentlab](), [developer](), [devops](), [executive](), [iac-security](), [interest](), [open-source](), [open-source-security](), [pull-requests](), [releases](), [resilience](), [sbom](), [secrets](), [security](), [snyk-cloud](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [vulnerability]() ### AI overview JPMorganChase's 10-point cyber resilience checklist addresses enterprise security priorities spanning software versions, open-source dependencies, SBOMs, build pipelines, secrets, infrastructure as code, and AI development. The article explains how Snyk covers eight of the ten actions through developer workflows and its security platform. ### Source excerpt JPMorganChase published a 10-point cyber resilience checklist. See how Snyk covers 8 of the 10 actions and where it fits in your security stack. ## I Read Cursor's Security Agent Prompts, So You Don't Have To DevFeed: [I Read Cursor's Security Agent Prompts, So You Don't Have To]() Original publisher: [Read original article]() Author: Randall Degges Published: 2026-03-17T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [cursor](), [Securing AI](), [ai security](), [Vulnerabilities](), [MCP Server](), [Orchestration](), [Prompt Engineering](), [Terraform](), [Persistence](), [Architecture & Design]() Tags: [agent](), [agentic](), [agents](), [ai](), [ai-security](), [application-security](), [automation](), [awareness](), [blog](), [ci-cd](), [cursor](), [developer](), [devops](), [executive](), [infrastructure](), [interest](), [mcp](), [mcp-server](), [orchestration](), [persistence](), [related-content](), [review](), [sbom](), [scm](), [secrel](), [secrets](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [terraform](), [vs-code](), [vulnerabilities]() ### AI overview The article examines Cursor's security review automation, which uses four autonomous agents to review more than 3,000 pull requests weekly, identify more than 200 vulnerabilities, and open fix pull requests. It argues that the concise prompts are only one part of the system; the larger achievement is the production infrastructure supporting persistence, deduplication, deployment, webhook orchestration, and state management. ### Source excerpt Cursor built AI security agents that review 3,000+ PRs weekly and catch 200+ vulnerabilities. Here's what they get right--and what's missing for enterprise security. ## Introducing Chainguard Commercial Builds: Secure-by-default containers for commercial software DevFeed: [Introducing Chainguard Commercial Builds: Secure-by-default containers for commercial software]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard commercial builds](), [Containers](), [open-source-security](), [supply-chain-security](), [Open Source](), [Security]() Tags: [azul](), [chainguard](), [chainguard-commercial-builds](), [chainguard-containers](), [containers](), [elastic](), [f5-nginx](), [gitlab](), [grafana-labs](), [open-source-software](), [partnership](), [provenance](), [sbom](), [secure-by-default](), [supply-chain-security](), [vulnerabilities]() ### AI overview Chainguard announces Commercial Builds, a partnership program with commercial and open source software providers. The program packages their software with the Chainguard Factory to provide hardened container images and support more consistent software supply chain security. ### Source excerpt Chainguard Commercial Builds is a new partnership program with commercial and open source software providers to package software using the Chainguard Factory. ## RED DA Assessment Tool for ESP-IDF EN 18031 Self-Assessment DevFeed: [RED DA Assessment Tool for ESP-IDF EN 18031 Self-Assessment]() Original publisher: [Read original article]() Author: John Lee Published: 2026-03-17T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [EN 18031](), [ESP32](), [ESP-IDF](), [Internet of things]() Tags: [blog](), [compliance](), [en-18031](), [esp-idf](), [esp32](), [iot](), [red-directive](), [regulatory](), [sbom]() ### AI overview This tutorial explains Espressif's RED DA Assessment Tool for ESP-IDF projects. The web application reads configuration files, scans an SBOM for known vulnerabilities, pre-fills a security questionnaire, and generates documentation for RED Delegated Act EN 18031 self-assessment. ### Source excerpt The RED DA Assessment Tool simplifies the process of achieving cybersecurity compliance for ESP32 devices in line with the EU's EN 18031 standards. This article explains how the tool helps you gather, validate, and generate all necessary documentation for RED Delegated Act self-assessment, including uploading configuration and SBOM files, completing risk assessments, mapping technical requirements, and preparing a declaration of conformity--making self-declaration fast, accurate, and accessible for IoT developers. ## Staying Ahead with ESP32 Security Updates DevFeed: [Staying Ahead with ESP32 Security Updates]() Original publisher: [Read original article]() Author: John Lee Published: 2026-03-05T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [ESP32](), [Security](), [vulnerability management](), [cyber resilience act](), [dashboards](), [ESP-IDF](), [Espressif](), [software bill of materials]() Tags: [blog](), [cyber-resilience-act](), [dashboards](), [esp-idf](), [esp32](), [espressif](), [iot](), [lts](), [ota](), [sbom](), [security](), [vulnerability]() ### AI overview This article explains how the ESP32 ecosystem supports long-term firmware security and compliance under regulations such as the EU Cyber Resilience Act. It covers vulnerability management, secure OTA updates, Long-Term Support branches, the ESP-IDF Security Dashboard, and SBOMs for tracking affected components and patched versions. ### Source excerpt This article explains how manufacturers can use the ESP32 ecosystem to build and maintain secure firmware over time, especially in light of new regulations like the EU Cyber Resilience Act. It highlights tools such as vulnerability dashboards, Long-Term Support branches, and secure OTA updates to ensure ongoing compliance and device security. ## Snyk and uv, Better Together DevFeed: [Snyk and uv, Better Together]() Original publisher: [Read original article]() Author: Ryan Searle Published: 2026-02-24T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Package Management](), [Python](), [supply-chain-security](), [AI Development](), [Vulnerabilities](), [JSON](), [Maintainers](), [GitHub](), [toolchain](), [pip](), [Poetry]() Tags: [ai](), [ai-development](), [application-security](), [awareness](), [blog](), [code-security](), [developer](), [development](), [devrel](), [enablement](), [executive](), [github](), [interest](), [json](), [maintainers](), [package-management](), [pmm](), [python](), [related-content](), [sbom](), [security](), [supply-chain-security](), [toolchain](), [vulnerabilities]() ### AI overview Snyk and uv have partnered to combine uv's high-performance Python package management with supply chain security. Their collaboration adds native CycloneDX SBOM export to uv, enabling Snyk vulnerability and license-compliance testing for uv-managed projects. ### Source excerpt Snyk and uv have teamed up to provide high-performance package management with native security for Python-based AI development. Build, install, and secure your AI-native applications from inception with Snyk's native support for the uv ecosystem. ## Chainguard + Second Front: A faster, more secure path into government markets DevFeed: [Chainguard + Second Front: A faster, more secure path into government markets]() Original publisher: [Read original article]() Published: 2026-02-20T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [container images](), [DevSecOps](), [supply-chain-security](), [Vulnerabilities](), [Deployment](), [Cybersecurity]() Tags: [chainguard](), [chainguard-containers](), [chainguard-for-compliance](), [cmmc](), [container-image-compliance](), [container-images](), [cve-remediation](), [cybersecurity](), [devsecops](), [federal-compliance](), [fedramp](), [government](), [iso](), [provenance](), [sbom](), [second-front-systems](), [secure-by-default](), [secure-by-design](), [security](), [soc-2](), [software-supply-chain]() ### AI overview Chainguard and Second Front are partnering to help software companies pursue federal market requirements, including FedRAMP authorization and DoD impact-level accreditations. The article describes combining Chainguard's hardened container images with Second Front's Game Warden DevSecOps platform to support secure application delivery and vulnerability reduction. ### Source excerpt Discover how Chainguard and Second Front are partnering to help build a secure path into government markets for your organization. ## Super SBOMs: See exactly what's inside DevFeed: [Super SBOMs: See exactly what's inside]() Original publisher: [Read original article]() Published: 2026-01-29T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [Containers](), [chainguard](), [Security](), [spdx]() Tags: [chainguard-containers](), [chainguard-sboms](), [containers](), [cyclonedx](), [fedramp](), [sbom](), [sboms](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vulnerability]() ### AI overview Chainguard Containers now provide richer SBOMs with binary-level details about embedded libraries and dependencies, along with CycloneDX support in addition to SPDX. The added visibility helps teams trace vulnerabilities and assess license compliance. ### Source excerpt Chainguard Containers ship richer SBOMs with binary-level library details plus new CycloneDX support, making CVE impact and compliance tracing fast and clear. ## Evo Adds CycloneDX Support to Give Full AI Visibility DevFeed: [Evo Adds CycloneDX Support to Give Full AI Visibility]() Original publisher: [Read original article]() Author: John Carione Published: 2025-12-19T05:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Artificial Intelligence](), [Security](), [Open Source]() Tags: [ai](), [application-security](), [awareness](), [blog](), [compliance](), [cyclonedx](), [developer](), [enterprise](), [governance](), [provenance](), [sbom](), [security](), [supply-chain](), [supply-chain-security]() ### AI overview Evo's Discovery Agent now supports CycloneDX 1.6 AI ModelCards, enabling portable AI Bills of Materials that inventory models, dependencies, provenance, licensing, and related metadata within existing SBOM workflows. The integration addresses enterprise security, compliance, and visibility gaps across AI supply chains. ### Source excerpt Enterprises face a critical visibility gap in AI models, creating security and compliance risks. Evo's new integration with CycloneDX 1.6 delivers intelligent, actionable AI-BOMs, providing complete oversight and robust governance for your entire AI supply chain. ## Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers DevFeed: [Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers]() Original publisher: [Read original article]() Author: Liran Tal Published: 2025-12-03T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [MSP MCP](), [Vulnerabilities](), [cursor](), [Node.js]() Tags: [agentic-coding](), [ai](), [ai-agent](), [application-security](), [awareness](), [blog](), [ci-cd](), [developer](), [devrel](), [devsecops](), [engineering](), [javascript](), [mcp](), [mcp-server](), [node-js](), [sbom](), [scm](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [vs-code](), [vulnerabilities]() ### AI overview A tutorial on using AutoMCP to configure Model Context Protocol servers for AI coding tools, connecting dependency context and Snyk scanning to AI-assisted development. ### Source excerpt Supercharge your AI agent! Learn how AutoMCP integrates Model Context Protocol (MCP) servers and Snyk Studio for secure, context-aware AI-driven development. ## Expanding Chainguard VMs: Zero-CVE Application & Base Virtual Machine Images for Cloud and On-Prem DevFeed: [Expanding Chainguard VMs: Zero-CVE Application & Base Virtual Machine Images for Cloud and On-Prem]() Original publisher: [Read original article]() Published: 2025-09-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard vms](), [Cloud](), [on-prem](), [chainguard os](), [Java](), [Jenkins](), [nginx](), [Python]() Tags: [chainguard-vms](), [cloud](), [cloud-virtual-machines](), [cve](), [java](), [jenkins](), [nginx](), [on-prem](), [os](), [provenance](), [python](), [rebuilds](), [sbom](), [secure-by-default](), [security-vm-images](), [virtual-machine-images](), [zero-cves]() ### AI overview Chainguard VMs is expanding with zero-CVE application images for Jenkins, Nginx, and Squid Proxy, plus base images for Chainguard OS, Java, and Python. The virtual machine images support cloud and on-premises deployments and are continuously rebuilt from source with automated updates, CVE remediation, and SBOM-driven provenance attestations. ### Source excerpt Chainguard VMs is expanding with new Application and Base VM Images -- giving teams a secure, zero-CVE foundation to build and innovate faster. ## Malware-Resistant Python without the Guesswork DevFeed: [Malware-Resistant Python without the Guesswork]() Original publisher: [Read original article]() Published: 2025-08-01T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries for python](), [chainguard libraries](), [Security](), [chainguard](), [Open Source](), [Malware]() Tags: [chainguard-libraries](), [chainguard-libraries-for-python](), [malicious-packages](), [malware](), [num2words](), [provenance](), [pypi](), [python](), [reproducibility](), [sbom](), [secure-packages](), [security](), [signing](), [slsa](), [supply-chain]() ### AI overview The article presents Chainguard Libraries for Python as a way to reduce malware and software supply chain risks in Python package consumption. It describes rebuilding packages from upstream source in an isolated, reproducible SLSA Level 2 environment, and publishing signed SBOMs and provenance information. ### Source excerpt The recent compromise of the num2words package never made it into Chainguard Libraries for Python. Get the breakdown from the team on our packages you can trust. ## Why Golden Images still matter and how to secure them with Chainguard DevFeed: [Why Golden Images still matter and how to secure them with Chainguard]() Original publisher: [Read original article]() Published: 2025-05-22T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [DevOps](), [software bill of materials](), [Software](), [cloud-infrastructure](), [Open Source]() Tags: [aws](), [azure](), [chainguard](), [chainguard-containers](), [container-image](), [container-images](), [containers](), [devops](), [golden-image](), [golden-images](), [how-to](), [provenance](), [sbom](), [security](), [zero-cves]() ### AI overview This article explains why well-managed golden image programs remain important for modern software delivery. It describes how continuously rebuilt, patched, signed, scanned, and versioned images--with SBOMs, attestations, provenance, and policy compliance--can improve security and streamline development workflows, while presenting Chainguard as an alternative to homegrown programs. ### Source excerpt Golden container image programs can be a great way to increase efficiency and security for your engineering team. Learn how to do it right with Chainguard. ## Creating SBOMs with the Snyk CLI DevFeed: [Creating SBOMs with the Snyk CLI]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2025-02-05T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [open-source-security](), [Security](), [Command-line interface](), [Vulnerabilities](), [Software](), [DevOps]() Tags: [2025](), [acquisition](), [application-security](), [blog](), [cli](), [compliance](), [developer](), [devops](), [devrel](), [java](), [open-source-security](), [sbom](), [sboms](), [security](), [snyk-open-source](), [snyk-platform](), [software-bill-of-materials](), [vulnerabilities]() ### AI overview This article explains software bills of materials (SBOMs), their importance for open source security and compliance, and how the Snyk CLI can help create them. It describes SBOMs as inventories of software components, dependencies, versions, and licensing information, and explains how they help assess vulnerability exposure. ### Source excerpt In this post, we'll delve into what SBOMs are, why they're necessary, and their role in open source security. ## Understanding the EU's Cyber Resilience Act (CRA) DevFeed: [Understanding the EU's Cyber Resilience Act (CRA)]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-01-22T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [cyber resilience act](), [supply-chain-security](), [Security](), [sdlc](), [Application Security](), [snyk]() Tags: [awareness](), [blog](), [compliance](), [cyber-resilience-act](), [eu](), [executive](), [megawatt](), [sast](), [sbom](), [sca](), [sdlc](), [secure-by-design](), [security](), [snyk](), [software-supply-chain-security](), [supply-chain-security]() ### AI overview The article explains how the EU Cyber Resilience Act (CRA) establishes cybersecurity requirements for products with digital elements. It discusses secure-by-design practices, vulnerability handling throughout the product lifecycle, upcoming reporting and compliance deadlines, and the role of SAST, SCA, and software supply chain security. ### Source excerpt Find out how the Cyber Resilience Act (CRA) sets new security standards for the EU and how Snyk can help simplify compliance with its developer-friendly tools. ## Software Bill of Materials (SBOM) for your Spin Apps DevFeed: [Software Bill of Materials (SBOM) for your Spin Apps]() Original publisher: [Read original article]() Author: Thorsten Hans Published: 2025-01-16T12:00:00Z Content type: tutorial Language: en Sources: [Fermyon - Experience the next wave of cloud computing.]() Topics: [software bill of materials](), [supply-chain-security](), [trivy](), [Open Source](), [Requirements](), [Software]() Tags: [open-source](), [regulatory](), [sbom](), [software-bill-of-materials](), [software-supply-chain](), [supply-chain](), [trivy]() ### AI overview A tutorial on creating Software Bills of Materials for Spin apps, addressing regulatory requirements and software supply chain security with open-source tools such as Trivy. ### Source excerpt Learn how to create SBOMs for Spin apps, meet regulatory requirements, and secure your software supply chain with open-source tools like Trivy [Next page]()