Tag
6 articles tagged #Supply Chain.
P.01pnpm versions before 10.34.0 and 11.4.0 could send your unscoped npm auth token to whatever registry a repository's .npmrc pointed at. Here's how the leak works, who's exposed, and how to check and fix it.
P.02Three malicious gems published from a hijacked, six-year-dormant RubyGems account are checking for CI environment variables and refusing to run there, targeting developer machines instead. Here's what SleeperGem does and how to check if you pulled it.
P.03On July 11, 2026, attackers used a stolen publishing credential to push five malicious versions of the jscrambler npm package, each carrying a 7.8MB cross-platform infostealer. Here's what it stole and how to check if you're affected.
P.04A step-by-step methodology for implementing Software Bill of Materials (SBOM) generation, dependency scanning, and vulnerability management in your CI/CD pipeline.
P.05Strip away the crypto speculation and NFT mania. What is left of Web3 in 2026? Turns out, quite a lot — supply chain tracking, digital identity, smart contracts, and decentralized storage are quietly solving real problems.
P.06Supply chain attacks have surged 742% since 2019. SBOMs are now legally mandated for federal software and EU market access. Here is how to implement them without slowing down your CI/CD pipeline.