Tag archive
What ZoomEye's GitLab counts reveal about self-managed code host exposure, and why a file-read flaw on a system holding deployment credentials is a supply chain problem.
Three self-propagating npm campaigns in twelve months: the TanStack compromise in May, ChainDrop through keyv in August, 400 plus packages backdoored from one stolen token. Auditing won't get you out of this. These are the controls that actually stop a worm at the door, with the config for each.
ChainDrop Had Valid Provenance. That Was Not Enough. Attackers hijacked the GitHub account...
A ZoomEye measurement of build-chain tooling exposure, with a scale comparison against widely deployed management interfaces.
Most supply-chain security checks the package: does it exist, is it new, is there a CVE against this...
TL;DR: An Ed25519 signature proves that a registered private-key holder signed an evidence record; it...
CVE-2026-75939 lets a forged PGP message pass oc-mirror validation and push a malicious release into a disconnected OpenShift registry.
Introduction A recent purchase at Winners has sparked curiosity and concern among...
An artefact repository stores internal releases and proxy credentials; two counts are read against anonymous access and service accounts.
The Fragile Chain: Engineering Resilience Through Structured Supply Chain Continuity...
What actually landed in mcp-guard this week: an npm attestations verifier whose happy path could never fire (caught in review), keyword matching without false positives, and exit codes as API.
Signing an image proves who built it. Provenance, admission enforcement and key custody are what turn that proof into a control.