Skip to content

Forem

# supplychain

👋 Sign in for the ability to sort posts by relevant, latest, or top.

Pico

May 5

MCPwn Is Live. We Scanned the Supply Chains of 14 MCP Servers. Here's What We Found.

#security #mcp #supplychain #javascript

5 min read

David Aronchick

May 5

One Year of Liberation Day: What the Tariff Rollout Actually Revealed About AI Infrastructure

#ai #infrastructure #supplychain #distributedcomputing

8 min read

Vincenzo Rubino

May 4

161 verified AI package hallucinations across 8.5M indexed — open dataset

#ai #security #supplychain #mcp

4 min read

Pico

May 4

Two Independent Attack Surfaces: Why npm Provenance Doesn't Make a Package Safe

#npm #security #javascript #supplychain

3 min read

Pico

May 4

Two Types of npm Supply Chain Attack: What Catches Each

#npm #security #supplychain #javascript

5 min read

Pico

May 4

certifi has 350M weekly downloads and one publisher. It handles your SSL certificates.

#python #security #supplychain #npm

4 min read

Michael Kayode Onyekwere

May 1

Four MCP packages, four ways the supply chain shifted in two weeks of npm monitoring

#security #supplychain #mcp #npm

7 min read

Apr 30

Slopsquatting in Python: What 205,474 Hallucinated Package Names Mean for Your Supply Chain

#python #security #ai #supplychain

8 min read

Cover image for Hacking GitHub: From Tag Rewrites to Dangling Commits, Where the Git Protocol Trusts You Without Checking

kt

Apr 30

Hacking GitHub: From Tag Rewrites to Dangling Commits, Where the Git Protocol Trusts You Without Checking

#security #github #git #supplychain

19 min read

Cover image for I built chainscope: reading supply chain attacks across 6 surfaces, one slide at a time

kt

Apr 29

I built chainscope: reading supply chain attacks across 6 surfaces, one slide at a time

#showdev #security #supplychain

7 min read

Cover image for SLSA Provenance Hands-on: Generate with GitHub Actions, Verify with slsa-verifier

kt

Apr 29

SLSA Provenance Hands-on: Generate with GitHub Actions, Verify with slsa-verifier

#security #supplychain #slsa #sigstore

11 min read

Cover image for Why Did Docker Abandon TUF?: A Turbulent History of Container Signing

kt

Apr 28

Why Did Docker Abandon TUF?: A Turbulent History of Container Signing

#security #docker #supplychain #sigstore

10 min read

RC

Apr 27

The power adapter was the attack

#hardwareimplant #supplychain #physicalsecurity #redteam

7 min read

Pico

Apr 26

The Anthropic SDK Looks Safe. Two of Its Transitive Dependencies Are Not.

#security #npm #javascript #supplychain

3 min read

RC

Apr 27

A postcard breached a warship

#physicalsecurity #iotthreats #redteam #supplychain

5 min read

👋 Sign in for the ability to sort posts by relevant, latest, or top.