# supply chain attacks Published articles for supply chain attacks. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Solving Gradle metadata and Renovate integration DevFeed: [Solving Gradle metadata and Renovate integration]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-16T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Gradle](), [renovate](), [Kotlin](), [Groovy]() Tags: [ci](), [dependencies](), [dependency](), [development](), [gradle](), [renovate](), [software-supply-chain](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview The article describes setting up Renovate for a Gradle project and investigating why merges of updated dependency versions caused build failures. It also discusses dependency verification and software supply chain risks. ### Source excerpt My current company has settled on using Gradle. It doesn't make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc. This week, I worked on improvements to a new project and set up Renovate. ## Announcing a Trillion Dollar Security grant for WEBCAT DevFeed: [Announcing a Trillion Dollar Security grant for WEBCAT]() Original publisher: [Read original article]() Author: Ethereum Foundation Access Cluster Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Security](), [Open Source](), [browsers](), [Front end](), [Firefox]() Tags: [announce](), [browsers](), [ethereum](), [firefox](), [front-end](), [funding-coordination](), [open-source](), [security](), [signing](), [supply-chain-attacks](), [web-applications]() ### AI overview The Ethereum Foundation's Trillion Dollar Security initiative announced a grant to the Freedom of the Press Foundation to support continued development of WEBCAT, an open source tool that enables browsers to verify whether code served by enrolled websites matches code published by their developers. The grant will also support bringing this protection to Ethereum wallets and apps. ### Source excerpt The Ethereum Foundation's Trillion Dollar Security (1TS) initiative is proud to announce a grant allocation to Freedom of the Press Foundation (FPF) to support the continued development of WEBCAT. WEBCAT is an open source tool that lets browsers verify that code served by an enrolled website matches what its developers... ## AI coding tools can increase dependency and npm supply-chain risks DevFeed: [AI coding tools can increase dependency and npm supply-chain risks]() Original publisher: [Read original article]() Author: Shibam Dhar Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [ai-coding](), [Security](), [npm](), [Open Source]() Tags: [ai](), [ai-coding](), [npm](), [open-source](), [security](), [social-engineering](), [supply-chain-attacks]() ### AI overview The article explains that AI coding assistants can rapidly introduce vulnerable, malicious, or non-compliant open-source dependencies. It presents Harness Artifact Registry's Dependency Firewall as a registry-level control point for evaluating and blocking risky packages before they enter a CI/CD pipeline. ### Source excerpt AI coding tools can introduce vulnerable dependencies fast. Learn how dependency firewalls block risky packages at the registry level. Explore now. | Blog ## Security Risks in Modern JavaScript Frameworks: React, Dependencies, and Client-Side Data Handling DevFeed: [Security Risks in Modern JavaScript Frameworks: React, Dependencies, and Client-Side Data Handling]() Original publisher: [Read original article]() Author: snehaa Published: 2026-06-10T09:09:52Z Content type: article Language: en Sources: [Backend Archives | Talent500 blog]() Topics: [Security](), [JavaScript](), [React](), [Web](), [web applications]() Tags: [api](), [authentication](), [backend](), [csp](), [framework-vulnerabilities](), [frontend](), [frontend-security](), [javascript](), [javascript-security](), [newsletters](), [npm-security](), [react](), [react-security](), [security](), [supply-chain](), [supply-chain-attacks](), [technology](), [vulnerabilities](), [xss]() ### AI overview The article examines security risks in modern JavaScript applications, focusing on React data handling, dangerous DOM sinks, dependency supply-chain complexity, and configuration issues that can contribute to XSS, injection, data leakage, and vulnerable code reaching production. ### Source excerpt Modern JavaScript frameworks have transformed how web applications are built, but they have also introduced new, less visible security risks. [...] The post Hidden Security Risks in Modern JavaScript Frameworks appeared first on Talent500 blog. ## The expanding threat landscape: Chainguard now scans source code for traditional malware and "greyware" DevFeed: [The expanding threat landscape: Chainguard now scans source code for traditional malware and "greyware"]() Original publisher: [Read original article]() Published: 2026-06-09T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Malware](), [Code](), [Open Source](), [npm](), [npm packages](), [Security]() Tags: [chainguard](), [chainguard-libraries](), [ecosystems](), [greyware](), [greyware-scanner](), [hardening](), [javascript](), [malware](), [malware-prevention](), [malware-scanner](), [npm](), [npm-packages](), [open-source](), [packages](), [scanner](), [security](), [source](), [supply-chain-attacks]() ### AI overview Chainguard has introduced a source code scanner that detects traditional malware and "greyware," harmful packages that may perform actions such as credential theft, command interception, API key harvesting, or persistent remote access. The scanner currently protects npm packages, scans more than 100,000 packages daily, and has blocked more than 52,000 packages identified as malware or greyware. ### Source excerpt Chainguard's new scanner blocks malware and 'greyware' before it reaches developers, protecting 100,000+ packages daily across open source ecosystems. ## We Will Not Sabotage Your Code DevFeed: [We Will Not Sabotage Your Code]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-06-03T00:00:00Z Content type: opinion Language: en Sources: [CodeName One]() Topics: [prompt injection](), [Open Source](), [supply chain attacks](), [Maintainers](), [Artificial Intelligence]() Tags: [agents](), [ai](), [maintainers](), [open-source](), [prompt-injection](), [supply-chain-attacks](), [trust]() ### AI overview This opinion argues that embedding a destructive prompt-injection payload targeting AI agents in an open-source framework is sabotage and a serious breach of maintainer trust. It rejects weaponizing dependencies against downstream users while acknowledging fears about AI's effects on developers and expressing optimism about AI's potential for open source. ### Source excerpt A maintainer hid a destructive prompt-injection payload aimed at AI agents inside his own framework. That is a betrayal of the trust open source runs on. Here is where we stand, and why I think AI is the biggest opportunity small OSS players have ever had. ## Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026 DevFeed: [Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-06-02T02:34:08Z Content type: news Language: en Sources: [T.J. Maher]() Topics: [open-source-security](), [supply-chain-security](), [Malware](), [npm](), [PyPI](), [GitHub](), [software composition analysis](), [Security]() Tags: [github](), [malware](), [npm](), [open-source](), [pypi](), [sca](), [security](), [software-supply-chain](), [sqgne](), [supply-chain](), [supply-chain-attacks]() ### AI overview The Software Quality Group of New England will host a June 17, 2026 meeting featuring Bryan Whyte of Sonatype on open-source malware and software supply chain defense. The session will cover threats targeting npm, PyPI, GitHub, and development pipelines; differences between open-source malware and traditional malware or vulnerabilities; and common tactics used in software supply chain attacks. ### Source excerpt "Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats" will be the topic of the next Software Quality Group of New England (sqgne.org) meeting. Speaker: Bryan Whyte, CISSP Director, Solutions Engineering @Sonatype Date: June 17, 2026 @ 6:00 pm Join us on Zoom or in person at Burlington, MA ( Register Here ) "Bryan Whyte breaks down the latest wave of open source malware, explains how these threats diverge from traditional vulnerabilities, and shares actionable steps for organizations to defend mission-critical software. "As organizations deepen their reliance on open-source software, evolving security threats are reshaping the landscape at an unprecedented pace. "Threat actors are now increasingly targeting development pipelines and trusted ecosystems like npm to orchestrate supply chain attacks with significant downstream impact. Incidents such as the 2025 Shai-Hulud npm campaign, the XZ Utils backdoor, and the widespread compromise of over 23,000 GitHub repositories illustrate how open-source malware has quickly become a critical, top-tier threat built to evade legacy scanning and exploit trust woven into modern delivery pipelines. "--The shifting tactics of threat actors targeting npm, PyPi, GitHub, and development pipelines "--Key differences between open-source malware and traditional malware or vulnerabilities "--The most prevalent malware types and tactics driving today's software supply chain attacks "After spending 20 years in software development, Bryan started his journey into Application Security in 2015 with the AppScan tool suite for Static, Dynamic and Mobile Application Security Testing. In 2018, he expanded his Cybersecurity proficiency, earning the Certified Information Systems Security Professional (CISSP). In 2019, he was excited to join Sonatype due to the explosive growth of open-source software, which has made Software Composition Analysis (SCA) a critical aspect of Application Security". See you there! Happy Testing ## Chainguard and Upwind: Secure what you build. Verify what you run. DevFeed: [Chainguard and Upwind: Secure what you build. Verify what you run.]() Original publisher: [Read original article]() Published: 2026-05-26T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard libraries](), [supply-chain-security](), [malicious packages](), [Application Security](), [Vulnerabilities]() Tags: [application-security](), [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-python](), [chainguard-scanners](), [chainguard-upwind](), [cybersecurity](), [malicious-packages](), [malware-scanners](), [security](), [supply-chain-attacks](), [upwind](), [vulnerabilities]() ### AI overview Chainguard announces that Upwind now scans Chainguard Libraries for Python. The article describes combining trusted software artifacts with runtime visibility to reduce noise and supply chain risk. ### Source excerpt Chainguard and Upwind combine trusted, source-built artifacts with runtime verification to cut noise, reduce risk, and secure AI-era software. ## Stytch & Latacora: A Security Partnership Retrospective DevFeed: [Stytch & Latacora: A Security Partnership Retrospective]() Original publisher: [Read original article]() Published: 2026-05-22T16:00:00Z Content type: article Language: en Sources: [Latacora]() Topics: [Security](), [Authentication](), [Incident response](), [SIEM, Security, Observability](), [supply chain attacks](), [MFA]() Tags: [2025](), [acquisition](), [authentication](), [incident-response](), [integration](), [partnership](), [retrospective](), [security](), [siem](), [supply-chain-attacks]() ### AI overview A retrospective on Stytch and Latacora's security partnership from 2021 through Stytch's acquisition by Twilio. It describes building security into passwordless authentication infrastructure, scaling detection and response, addressing SAML vulnerabilities and supply chain attacks, and maintaining monitoring during the acquisition. ### Source excerpt From growing startup to Twilio integration # Stytch and Latacora worked side by side to ensure that the developers and end users relying on Stytch's platform benefited from a security program built for the sensitivity and criticality of the data involved. This journey, which began in February 2021, saw Stytch grow from an ambitious startup building passwordless authentication infrastructure into a mature platform, ultimately acquired by Twilio. ## Cyber resiliency in practice: Lessons from recent supply chain attacks DevFeed: [Cyber resiliency in practice: Lessons from recent supply chain attacks]() Original publisher: [Read original article]() Published: 2026-05-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [resiliency](), [supply chain attacks](), [supply-chain-security](), [axios](), [GitHub Actions](), [litellm](), [trivy](), [npm](), [PyPI](), [Python](), [Large Language Model]() Tags: [axios](), [chainguard-libraries](), [cyber-resiliency](), [cybersecurity](), [github-actions](), [litellm](), [malware](), [npm](), [pypi](), [python](), [security](), [security-attacks](), [social-engineering](), [software-supply-chain-security](), [supply-chain-attacks](), [trivy](), [worm]() ### AI overview The article defines cyber resiliency as an integrated ability to anticipate, withstand, recover from, and adapt to attacks across the full Protect, Detect, Respond, and Recover lifecycle. It examines recent supply chain attacks involving Trivy, Axios, and LiteLLM, highlighting risks such as GitHub Actions misconfiguration, long-lived tokens, incomplete credential rotation, mutable Git tags, maintainer-account compromise, and malicious package releases. ### Source excerpt Learn how modern cyber resiliency helps organizations prevent, detect, and recover from supply chain attacks like Trivy, Axios, and LiteLLM. ## AI is finding vulnerabilities faster than anyone can patch them. Now what? DevFeed: [AI is finding vulnerabilities faster than anyone can patch them. Now what?]() Original publisher: [Read original article]() Published: 2026-04-10T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [Artificial Intelligence](), [supply-chain-security](), [Claude](), [anthropic](), [Maintainers](), [Open Source](), [Exploit](), [Operating system](), [browser]() Tags: [ai](), [anthropic](), [attacks](), [chainguard-for-ai](), [claude](), [claude-mythos-preview](), [cves](), [exploit](), [maintainers](), [open-source](), [project-glasswing](), [security](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain-attacks](), [vulnerabilities]() ### AI overview The article argues that AI systems such as Claude Mythos Preview are discovering zero-day vulnerabilities faster than organizations and open-source maintainers can patch them. It describes the resulting risks for software supply chains, including faster exploitation, uneven vendor response, and increased pressure on maintainers, while presenting verifiable-source, secure-by-default artifacts as a defensive approach. ### Source excerpt Project Glasswing and Claude Mythos Preview reveal a surge in zero-days. Learn why reactive patching fails and how secure-by-default supply chains keep you safe. ## Is Grype a single point of failure for Chainguard's CVE detection? DevFeed: [Is Grype a single point of failure for Chainguard's CVE detection?]() Original publisher: [Read original article]() Published: 2026-04-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [grype](), [chainguard](), [Malware](), [chainguard containers](), [Open Source](), [Containers]() Tags: [chainguard](), [chainguard-containers](), [chainguard-os](), [chainguard-scanners](), [containers](), [cve](), [grype](), [malware](), [open-source](), [source](), [supply-chain-attacks](), [trivy]() ### AI overview The article explains why Grype is not a single point of failure in Chainguard's CVE detection system. It describes layered defenses including building Grype from source, malware detection, and alternative input-source protections to improve the reliability of security findings. ### Source excerpt Is Grype a single point of failure? Learn how Chainguard uses layered defenses, source builds, and multiple data sources to ensure trusted CVE detection. ## Supply chain attacks expose weaknesses in open-source software trust DevFeed: [Supply chain attacks expose weaknesses in open-source software trust]() Original publisher: [Read original article]() Published: 2026-04-09T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [vulnerability](), [Exploit](), [npm]() Tags: [ai-coding](), [attacks](), [chainguard](), [code](), [dependency](), [hardening](), [npm](), [open-source](), [open-source-security](), [oss](), [pypi](), [scanner](), [secrets](), [software-supply-chain-security](), [solarwinds](), [supply-chain](), [supply-chain-attacks](), [trust](), [vibe-coding](), [vulnerability](), [vulnerability-scanner]() ### AI overview This opinion article argues that a series of open-source supply chain attacks exposed a broken trust model. It discusses attacks involving npm and PyPI packages, stolen credentials, malicious contributors, and the limits of vulnerability scanning and hardening. ### Source excerpt Five supply chain attacks in 12 days exposed a broken trust model. Learn why scanning and hardening fail, and why trusting the source is the only fix. ## Attacks rewritten: Where malware enters the build DevFeed: [Attacks rewritten: Where malware enters the build]() Original publisher: [Read original article]() Published: 2026-04-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Malware](), [CI/CD](), [Maintainers](), [Vulnerabilities]() Tags: [attacks](), [chainguard-libraries](), [ci-cd](), [maintainers](), [malware](), [package-malware](), [security](), [sha1-hulud](), [software-supply-chain](), [solarwinds](), [supply-chain](), [supply-chain-attacks](), [teampcp]() ### AI overview This article explains how modern software supply chain attacks can affect production deployments, CI/CD clusters, developer workstations, and other systems. It describes the shift from exploiting known production vulnerabilities to injecting malicious code upstream through compromised maintainer accounts, package managers, and binary dependencies. ### Source excerpt Modern supply chain attacks target CI, dev machines, and dependencies. Learn how building from source helps prevent malware and reduce risk. ## Docusaurus 3.10 DevFeed: [Docusaurus 3.10]() Original publisher: [Read original article]() Author: Sébastien Lorber Published: 2026-04-07T00:00:00Z Content type: release Language: en Sources: [Docusaurus Blog]() Topics: [releases](), [Documentation](), [Security](), [supply chain attacks](), [GitHub Actions](), [MDX](), [npm](), [OpenID connect (OIDC)](), [upgrade](), [monorepo](), [pnpm]() Tags: [github-actions](), [mdx](), [monorepo](), [npm](), [oidc](), [pnpm](), [release](), [security](), [supply-chain-attacks](), [upgrade]() ### AI overview Docusaurus 3.10 is the final release in the v3.x line and prepares sites for Docusaurus v4. It introduces future flags for upcoming breaking changes, makes Docusaurus Faster stable, and adds supply-chain security measures including npm Trusted Publishing, OIDC-based GitHub Actions releases, provenance records, and dependency checks. ### Source excerpt We are happy to announce Docusaurus 3.10. ## Reliability Engineering for Air-Gapped Systems DevFeed: [Reliability Engineering for Air-Gapped Systems]() Original publisher: [Read original article]() Author: Alex Ewerlöf Published: 2026-04-03T21:03:06Z Content type: article Language: en Sources: [Alex Ewerlof Notes]() Topics: [observability](), [systems](), [Resilience](), [on-prem](), [Security](), [Requirements]() Tags: [observability](), [on-prem](), [reliability-engineering](), [resilience](), [security](), [supply-chain-attacks](), [systems](), [work]() ### AI overview This article discusses reliability engineering for air-gapped systems where software teams cannot access runtime data, metrics, or logs. It describes using SLI and SLO practices, alerting, secure operational processes, and on-premises maintenance to manage reliability in systems isolated from the internet. ### Source excerpt Tips and tricks to work around inaccessible observability ## Malicious axios versions published to npm: Chainguard customers protected DevFeed: [Malicious axios versions published to npm: Chainguard customers protected]() Original publisher: [Read original article]() Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [axios](), [npm](), [Remote Access Trojan](), [Open Source](), [JavaScript](), [payload](), [Single-page application (SPA)](), [Filesystems](), [HTTP](), [Script](), [Linux](), [macOS]() Tags: [axios](), [axios-attack](), [axios-npm-attack](), [axios-supply-chain-attack](), [c2](), [chainguard-actions](), [chainguard-axios](), [chainguard-libraries](), [chainguard-npm-libraries](), [dependency](), [files](), [http](), [javascript](), [linux](), [macos](), [npm](), [npm-packages](), [payload](), [remote-access-trojan](), [script](), [supply-chain-attacks](), [windows]() ### AI overview The article reports that two malicious axios versions were published to npm with a hidden dependency that deployed a cross-platform remote access trojan on macOS, Windows, and Linux. It explains the compromised maintainer account, post-install execution, command-and-control communication, payload delivery, and recommended auditing and remediation steps. Chainguard customers were protected by package-blocking and source-verification controls. ### Source excerpt Malicious axios versions on npm delivered a RAT via a hidden dependency. Chainguard customers were protected by blocking unsafe packages and verifying source. ## The litellm PyPI compromise and how Chainguard Libraries blocked malicious releases DevFeed: [The litellm PyPI compromise and how Chainguard Libraries blocked malicious releases]() Original publisher: [Read original article]() Published: 2026-03-24T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [litellm](), [chainguard libraries](), [open-source-security]() Tags: [chainguard-libraries](), [chainguard-libraries-for-python](), [litellm](), [litellm-attack](), [litellm-package](), [litellm-supply-chain-attack](), [open-source-security](), [pypi](), [secure-packages](), [security](), [supply-chain-attacks]() ### AI overview The article describes a litellm compromise on PyPI in which malicious releases were used to steal secrets. It states that Chainguard Libraries prevented exposure by rebuilding only verified source and blocking the malicious releases. ### Source excerpt Hackers compromised litellm on PyPI to steal secrets. Chainguard Libraries prevented exposure by rebuilding only verified source, blocking malicious releases. ## Avoiding the Next Supply Chain Disaster with GitHub and Gradle DevFeed: [Avoiding the Next Supply Chain Disaster with GitHub and Gradle]() Original publisher: [Read original article]() Author: Tom Tresansky Published: 2026-02-25T05:00:00Z Content type: article Language: en Sources: [The Gradle Blog]() Topics: [supply-chain-security](), [Gradle](), [GitHub](), [Vulnerabilities](), [Reverse Dependencies](), [Java](), [Android](), [Maven](), [npm](), [Logging]() Tags: [dependencies](), [developers](), [github](), [gradle](), [java](), [locking](), [logging](), [npm](), [security](), [supply-chain](), [supply-chain-attacks](), [supply-chain-security](), [vulnerabilities]() ### AI overview This article explains how GitHub and Gradle can help Android and JVM developers reduce software supply-chain risk. It covers dependency drift, vulnerability exposure, resolved dependency visibility, continuous monitoring, automated fixes, and Build Scan® analysis, with Shai-Hulud and Log4Shell as examples of supply-chain threats. ### Source excerpt Supply chain security is a big deal, and it's dangerously easy to ignore. For Android or JVM developers, the sheer scale of the ecosystem is our greatest strength, and our greatest risk. When you build an application, you aren't just responsible for your own code; you're responsible for a massive, invisible tree of dependencies. This presents two distinct security challenges: Dependency Drift: Resolved dependencies can appear, disappear, or change versions without you ever touching your build.gradle.(kts) file. A bad actor can slip a malicious artifact into your dependency graph unnoticed. Vulnerability Exposure: Even locking your dependencies to avoid unexpected changes doesn't absolve you from monitoring their state. A library you've used for years might have a critical vulnerability (CVE) discovered tomorrow. We've recently seen this play out in the wild with attacks like the Shai-Hulud npm supply-chain exploit, where attackers poisoned popular packages to execute arbitrary code downstream, and the critical Log4Shell vulnerability, which demonstrated the catastrophic risk posed by an exploit in a foundational Java logging library. We recently outlined our defense against supply chain attacks in our deep dives on continuous GRC and our Nx vulnerability response. The good news: if your Gradle projects live on GitHub, you already have everything you need to minimize your known vulnerability count, without manually auditing resolved dependencies all day. In this post, we'll walk through how GitHub and Gradle work together to: Give you a complete, accurate view of your resolved dependencies Continuously monitor those dependencies for vulnerabilities Automatically propose and validate fixes Use our free Build Scan® service to understand what changed and why Why dependency monitoring is harder than it looks Unlike more traditional build tools like Maven, which rely on relatively static dependency declarations, Gradle is a dynamic, highly programmable build engine. While ## npm Token Changes Improve Supply-Chain Security but MFA Phishing and Bypass Tokens Remain Risks DevFeed: [npm Token Changes Improve Supply-Chain Security but MFA Phishing and Bypass Tokens Remain Risks]() Original publisher: [Read original article]() Published: 2026-02-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Security](), [MFA](), [Malware](), [OpenID connect (OIDC)](), [chainguard libraries]() Tags: [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-javascript](), [javascript-packages](), [malware](), [mfa](), [npm](), [oidc](), [phishing](), [secure-packages](), [supply-chain](), [supply-chain-attacks]() ### AI overview The article examines npm's authentication overhaul after the Sha1-Hulud incident. It explains that short-lived session tokens, default MFA for publishing, and OIDC Trusted Publishing improve security, but MFA phishing and optional 90-day tokens with MFA bypass still leave projects vulnerable to supply-chain attacks. ### Source excerpt npm's token changes help, but MFA phishing and optional bypass tokens still enable supply-chain attacks. Source-built Chainguard Libraries reduce the risk. ## Protect your AI workloads from supply chain attacks DevFeed: [Protect your AI workloads from supply chain attacks]() Original publisher: [Read original article]() Published: 2026-01-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [Containers](), [chainguard](), [Vulnerabilities](), [AI Strategy](), [Open Source](), [Security](), [PyTorch](), [Tensorflow](), [MLOps]() Tags: [ai](), [ai-containers](), [chainguard](), [chainguard-containers](), [chainguard-for-ai](), [chainguard-libraries](), [containers](), [cudnn](), [cves](), [data-processing](), [deployment](), [kserve](), [legacy](), [libraries](), [mlops](), [nemo](), [ollama](), [python](), [pytorch](), [security](), [security-vulnerabilities](), [supply-chain](), [supply-chain-attacks](), [zero-cve-containers]() ### AI overview The article discusses security and operational challenges in AI/ML workloads, including complex dependencies, bloated artifacts, infrastructure sprawl, and unremediated CVEs. It presents Chainguard Containers' minimal images for AI workloads as a way to reduce attack surface, storage needs, and deployment overhead, and cites a 50 MB gpu-operator image compared with a 170 MB upstream equivalent. ### Source excerpt Chainguard secures AI adoption with minimal, zero-CVE containers and source-built libraries that prevent supply chain malware while keeping developers fast. ## go.sum Is Not a Lockfile DevFeed: [go.sum Is Not a Lockfile]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-01-05T20:06:30Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [Go Language](), [modules](), [Security](), [supply chain attacks]() Tags: [dependencies](), [go](), [golang](), [modules](), [security](), [supply-chain-attacks]() ### AI overview The article explains that Go's go.sum is a local cache of cryptographic hashes for the Go Checksum Database, not a lockfile and not part of version resolution. It contrasts go.sum with go.mod, which lists the precise dependency versions used to build the main module and its tests. ### Source excerpt In Go, go.mod acts as both manifest and lockfile. There is never a reason to look at go.sum. ## Pinning GitHub Actions DevFeed: [Pinning GitHub Actions]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2025-11-17T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [GitHub Actions](), [Security](), [supply chain attacks](), [CI/CD](), [Dependabot]() Tags: [also](), [ci-cd](), [commit](), [dependabot](), [github-actions](), [security](), [supply-chain-attacks](), [workflow]() ### AI overview This tutorial explains why GitHub Actions should be pinned to full commit SHAs instead of mutable tags or branches. It describes the security and auditability benefits and introduces caarlos0/pinata, a tool that automates pinning and creates pull requests for review. ### Source excerpt If you're using GitHub Actions in your projects, you should be pinning your actions to specific commit SHAs instead of using tags or branches. ## Chainguard Libraries for Python: Now Generally Available with CVE Remediation and Malware Protection DevFeed: [Chainguard Libraries for Python: Now Generally Available with CVE Remediation and Malware Protection]() Original publisher: [Read original article]() Published: 2025-10-22T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries for python](), [chainguard libraries](), [Python](), [Malware](), [Open Source](), [supply-chain-security](), [Vulnerabilities]() Tags: [chainguard](), [chainguard-language-libraries](), [chainguard-libraries](), [chainguard-libraries-for-python](), [cve](), [cve-remediation](), [language-libraries-malware](), [malware-prevention](), [malware-protection](), [open-source](), [python](), [python-libraries](), [secure-python-libraries](), [software-supply-chain](), [supply-chain-attacks](), [vulnerabilities]() ### AI overview Chainguard Libraries for Python is generally available as a trusted-build distribution of open source Python libraries. It builds packages from source, distributes them through hardened infrastructure, continuously monitors them, and provides malware protection and CVE remediation through backported patches for selected critical and high-severity vulnerabilities. ### Source excerpt Chainguard Libraries for Python, trusted open source language libraries designed for CVE remediation and malware protection, is now generally available. [Next page]()