Your Dependency Tree Is an Attack Surface: Supply Chain Defense for npm and PyPI in 2026
Every `npm install` is an act of trust. You are executing code written by strangers, versioned by strangers, published through
Tag: Supply Chain Security
Software Supply Chain Security in 2026: Pinning, Provenance, Signing, and SBOMs That Get Consumed
A few years ago, “supply chain security” meant checking your Docker base images for critical CVEs and hoping your dependency
Defending Against Supply Chain Attacks: An npm and PyPI Defense Playbook
When a popular npm package turns malicious, the window between publication and detection is measured in hours, and the first
Continue readingDefending Against Supply Chain Attacks: An npm and PyPI Defense Playbook
HTTPX2 and the Art of the Open-Source Handover
In late August, OpenAI’s Python SDK — one of the most-installed packages on PyPI — quietly completed a migration to
Continue readingHTTPX2 and the Art of the Open-Source Handover
The keyv Worm and the Anatomy of a Modern Supply Chain Attack
On August 4, 2026, someone took over the GitHub account of the maintainer of keyv, a key-value storage abstraction library
Continue readingThe keyv Worm and the Anatomy of a Modern Supply Chain Attack
SBOMs in Practice: Generating, Scanning, and Surviving Supply Chain Audits
The software supply chain has become the soft underbelly of modern applications. While teams harden their APIs, patch their runtimes,
Continue readingSBOMs in Practice: Generating, Scanning, and Surviving Supply Chain Audits
What the OWASP Top 10:2025 Changes Mean for Your Codebase
OWASP has released the Top 10:2025 — the eighth edition of its flagship security awareness document — and the changes
Continue readingWhat the OWASP Top 10:2025 Changes Mean for Your Codebase