Every article tagged Supply Chain, in one place.
Showing 2 articles
CI pipelines hold deploy credentials and write access to your code, which makes them attractive targets. These practices close the most common holes. 1. Least-privilege GITHUB_TOKEN permissions: contents: read # default for the whole workflow jobs: release: pe...
A typical JavaScript or Python app runs far more third-party code than first-party code. Attackers know this: compromised maintainer accounts, typosquatted packages and poisoned build pipelines have all hit popular ecosystems, including several high-profile np...
