#Supply Chain Security

17,600 Actions Later, Only the Network Controls Held

Hugging Face's forensic timeline of the OpenAI agent breach shows exactly which defenses survive machine-speed chaining.

Article · 1mo ago0

GitHub's Malware Problem Isn't a Capability Gap

Ten thousand trojan repos vanished in hours, then came right back — and AI agents are now the targets.

Article · 1mo ago3

Supply Chain Security's Newest Control Is a Calendar

Dependabot's three-day default cooldown and PyPI's 14-day release freeze bet that patience beats scanners.

Article · 1mo ago0

An AI Agent Just Cheated on a Benchmark by Hacking a Company

OpenAI's models escaped their sandbox and breached Hugging Face using bugs your infrastructure probably still has.

Article · 1mo ago2

npm's Cooldown Works Because You Never Vetted Anything

The security-theater critique misreads who actually catches registry malware — but it's right about what attackers do next.

Article · 1mo ago0

Why a "Verified" GitHub Commit Hash Is Not Unique

Signature malleability allows attackers to alter verified commit hashes without breaking their cryptographic signatures or possessing private keys.

Article · 1mo ago0

Alibaba’s Claude Code Ban Exposes the Agentic Security Paradox

As AI coding assistants demand direct terminal access, the line between developer utility and system backdoor is rapidly blurring.

Article · 1mo ago2

Inside PinpinRAT: How APTs Hijack Developer Build Pipelines

A failed social engineering attack on a crates.io maintainer reveals highly stealthy local execution techniques.

Article · 2mos ago5

AI Coding Assistants Turn Local Git Repos Into Cloud Exploits

A high-severity Amazon Q flaw highlights how Model Context Protocol configurations let malicious repositories run code and steal credentials.

Article · 2mos ago2

The Cordyceps Exploits: Why Your CI/CD Pipelines Are Wide Open

A systemic workflow composition flaw exposes hundreds of major repositories, proving we must stop treating CI/CD as passive configuration.

Article · 2mos ago0

Apple Absorbs Swift Package Index. Watch the Signing Plan.

The acquisition looks like a discovery upgrade, but the real story is who controls trust and identity for Swift's supply chain.

News · 2mos ago2

GitHub Hardens actions/checkout to Block Pwn Request Attacks

The latest security update stops common pipeline exploits but leaves structural CI/CD risks for developers to manage.

Article · 2mos ago0

The GitHub Clone Farm That Beat VirusTotal

A 10,000-repo Trojan campaign weaponizes GitHub's trust signals, search ranking and commit history — and the next mark is your AI agent.

Article · 2mos ago2

Arch's AUR Malware Sprawl Hits 1,579 Packages

A user-repository compromise that started at 400 packages ballooned past 1,500 before Arch developers purged the malicious commits.

News · 2mos ago6

Homebrew 6.0.0 Makes You Trust Your Taps

The package manager now gates third-party tap code behind explicit trust and extends Bubblewrap sandboxing to Linux.

Release · 2mos ago7