Skip to main content

Filed under

Supply Chain

6 entries

  1. Supply Chain 8 min read

    The Repository Link That Points at Nobody

    About one declared repository link in seven no longer cloned anonymously, and for about a fifth of those the GitHub account it names no longer existed.

  2. Supply Chain 9 min read

    Provenance Attests the Pipeline, Not the Intent

    Three 2026 npm compromises shipped malware with valid provenance. Only one of them is visible in the signed fields, and a fourth shows what provenance does catch.

  3. Supply Chain 12 min read

    Patch Fast, Pull Slow: Defending in the Year of Copy Fail

    AI is finding bugs faster, researchers pile on the moment one drops, and registries ship malware by the hundred-thousand. Defenders are caught between two contradictory imperatives. The fix is architectural, not temporal.

  4. Supply Chain 6 min read

    Investigating the Trivy Supply Chain Compromise with AI Agents

    How I used AI-assisted investigation to triage the trivy-action supply chain attack across my homelab repos — and some thoughts on weekend incident response and community notification gaps.

  5. Container Security 11 min read

    NodeShield: Runtime SBOM Enforcement Stops 98% of Supply Chain Attacks

    NodeShield enforces SBOMs at runtime using CBOM policies to prevent supply chain attacks. Homelab Docker deployment guide with attack simulations, 98.3% prevention rate, and <1ms overhead.

  6. Supply Chain 15 min read

    Automated Security Scanning Pipeline with Grype and OSV

    Build automated security scanning pipelines with Grype, OSV, and Trivy—integrate vulnerability detection into CI/CD workflows with actionable reporting.