Tag

Software Supply Chain Security

62 articles

Latest in Software Supply Chain Security

Noma Security Discloses Claude Code Desktop Exploit

Security researchers at Noma Security uncovered SneakPeek, a vulnerability in Anthropic’s Claude Code Desktop that allowed malicious JavaScript embedded in large HTML files to bypass sandbox protections and silently steal sensitiv…

Oct 14, 20263 min

All Software Supply Chain Security Articles

Showing 1–24 of 62

Oct14

Blogs

GitHub Ties Every Commit to the Account That Pushed It

GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer informat…

3 min

Oct01

Blogs

DevOps Dozen 2026 Nominations Are Open: Recognizing the People and Technology Moving DevOps Forward

When we launched the DevOps Dozen in 2015, we wanted to recognize the people, projects and companies helping this community move forward. We saw the work happening across DevOps ev…

3 min

Sep24

Why Software Supply Chain Security Is Moving to the Gate

March 2026: malicious versions of axios get published directly to npm. May 2026: attackers forge valid provenance for 42 TanStack packages on npm, with 84 malicious versions shippe…

3 min

Sep24

Blogs

GitHub Gives Enterprises a Full Count of Who Holds the Keys

GitHub Enterprise Cloud now lets organizations export a full inventory of credentials, helping security teams identify stale, overprivileged and forgotten access across users, apps…

3 min

Sep23

Cycode Extends DevSecOps Reach to Software Packages Developers Download

Cycode is adding workstation-level protection to stop developers and AI coding agents from downloading malicious or insufficiently vetted software packages.

3 min

Sep23

Blogs

Why Shift Left is Dead

AI-driven development is exposing risks before code is written, forcing security teams to move beyond shift-left and govern agents, prompts, tools and data across the entire develo…

3 min

Sep11

Blogs

GitHub Widens the Door on Advanced Security Trials

GitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free.

3 min

Aug31

Broadcom Launches Trusted Artifact Service for Spring Framework

Broadcom launches TrueSource Trusted Artifacts to provide hardened Spring dependencies, secure open source packages and automated vulnerability remediation.

3 min

Aug21

Blogs

Why Cryptographic Inventory Is the First Step Toward Quantum Readiness

Post-quantum readiness starts with visibility. DevOps teams need a continuous cryptographic inventory to map algorithms, keys, certificates, libraries, infrastructure and third-par…

3 min

Aug13

The Agent Proposes, the Pipeline Disposes: Controls for AI-Authored Change

When agents write code and open pull requests faster than humans can read them, ‘the diff looked fine’ stops being a control. The durable controls live outside the agent’s reasonin…

3 min

Aug04

Blogs

Shift Left Security: 4 Automated Security Gates in GitHub Actions

Learn how to add four automated security gates to GitHub Actions using npm audit, Snyk, Trivy, CodeQL and OWASP ZAP—without an enterprise licence.

3 min

Jul31

CISA’s 2026 SBOM Guidance Adds Hash Requirements and AI Coverage

CISA’s updated 2026 SBOM minimum elements expand software transparency requirements to AI, SaaS and open source while adding hashes, licenses and stronger validation.

3 min

Jul27

Blogs

GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks

GitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads.

3 min

Jul22

Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem

A developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma…

3 min

Jun12

Blogs

Why Endpoint Protection Matters More than Ever in CI/CD Environments

CI/CD environments depend on far more than repositories and deployment infrastructure. Developer endpoints hold sensitive data: cloud credentials, SSH keys, deployment permissions,…

3 min

Jun09

Blogs

GitHub Takes Down 73 Microsoft Repos After Miasma Worm Attack

GitHub pulled 73 Microsoft repositories offline after the self-replicating Miasma worm weaponized IDEs and AI coding tools to harvest developer credentials.

3 min

Apr02

Blogs

Survey Surfaces Increased Reliance on Open Source Software to Build Apps

Open source adoption is surging, with 49% of IT teams increasing usage. However, 47% of staff spend 75% of their time on maintenance. Explore the impact of AI threats and EU regula…

3 min

Mar06

Video Interviews

Why AI-Generated Code Is Raising the Stakes for Secrets Management

Following a $50 million funding round, GitGuardian CEO Eric Fourrier discusses why secrets security is becoming a much bigger problem in the age of AI-generated code and autonomous…

3 min

Mar04

Blogs

Chainguard Expands Repository to Add More Secure Open Source Libraries

Learn how Chainguard is strengthening software supply chains by expanding its secure repository of Java, JavaScript, and Python libraries, enabling DevOps teams to access component…

3 min

Jan28

Contributed Content

Software Supply Chain Threats Are on the OWASP Top Ten—Yet Nothing Will Change Unless We Do

Software supply chain security is steadily moving to the forefront of cybersecurity conversations. In the past, it has been overshadowed by a focus on malware outbreaks, ransomware…

3 min

Dec18

Blogs

Checkmarx Acquisition of Tromzo Accelerates Plan to Apply AI to Application Security

Checkmarx accelerates its AI-driven DevSecOps strategy after acquiring Tromzo, integrating AI agents to automate application security across the software development lifecycle.

3 min

Nov25

Endor Labs Adds AI SAST Tool to Discover Vulnerabilities in Code

Endor Labs launches an agentic AI-powered SAST tool that drastically reduces false positives, identifies deeper code flaws and helps DevSecOps teams secure AI-generated code across…

3 min

Nov13

Blogs

JFrog Adds Ability to Track Usage of AI Coding Tools

JFrog introduces AI-Generated Code Detection and Shadow AI Detection tools to identify AI-created code, track model usage, and enhance DevSecOps governance across software supply c…

3 min