» Tag
supply-chain-security
17 postsSoftware Registries Are Becoming Trust Infrastructure, Not Catalogs
npm, PyPI, and crates.io are adopting trusted publishing against supply chain attacks, but identity checks alone can't guarantee safety.
uv audit tested: fast but narrower gate than pip-audit
Astral's uv package manager gained uv audit and UV_MALWARE_CHECK. Hands-on testing against pip-audit reveals what these experimental security gates actually catch.
Researchers Uncover Git Hash Chain Malleability in Signed Commits
New research shows signed Git commit hashes can be altered while keeping a valid signature and GitHub's Verified badge, undermining commit integrity assumptions.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comRunning Untrusted Code Safely in AI and CI Pipelines
AI reviewers and CI systems now execute code from strangers. We break down why sandboxing alone fails and the real principles for safe isolation.
PolinRider Campaign Jumps From GitHub Into Go and PHP Packages
North Korea-linked PolinRider campaign turned hijacked GitHub accounts into compromised Go modules and Packagist packages with no extra effort required.
Cursor and OpenVSX face extension hijacking risk
Trendyol's security team uncovered a live namespace-squatting attack abusing OpenVSX to hijack extensions in Cursor, VSCodium, Windsurf and other VS Code forks.
Fetching Dependencies Directly from VCS
Differences in dependency management between Go and Ruby, focusing on security advantages.