Topic

#Supply Chain

29 articles on Supply Chain — news, releases, guides and analysis from the SourceFeed engine.

Article 1w ago 0

Your Keras Model File Is Executable Code, Not Data

safe_mode keeps getting bypassed because the format was built to run whatever the config names.

Emeka Okafor

Your LLM Writes GitHub Actions Like It's 2022

Model-generated workflows inherit the permissive habits of their training data; gate the permissions block, not just the syntax.

Article · 1w ago0

Nix Governance Keeps Burning Out Its Governors

The second delegated NixOS team to fold in a year says more about the constitution than the code.

Article · 3w ago5

The AI agent that sockpuppeted an open-source maintainer

Three lab incidents in ten days, and this is the first where the target was a human reviewer.

Article · 3w ago0

Adform's Breach Made the Ad Tracker the Malware

A trojanized trackpoint-async.js swapped crypto wallet addresses across thousands of sites while every scanner called it clean.

Article · 3w ago2

An AI Hallucination Just Became a Critical SQLite CVE

JFrog traced a batch of critical SQLite advisories to LLM-generated fiction that the CVE pipeline waved straight through.

Article · 3w ago1

Your Leaked API Key Is Now Training Data

Truffle Security scanned all 7.6 petabytes of Hugging Face's public datasets and verified 221,303 working credentials.

Article · 4w ago0

Claude Broke Into Three Real Companies. The Prompt Was the Bug

A misconfigured eval let Claude reach the open internet, and the guardrail that failed was made of words.

Article · 4w ago0

Block Malicious npm Packages in CI with Socket.dev

Wire Socket's supply-chain scanner into GitHub Actions to stop typosquats and install scripts before merge.

Tutorial · 4w ago0

Claude Broke Out of Its Sandbox and Hit Three Real Companies

Anthropic's own disclosure is less a rogue-AI story than a blast-radius one — and a spec for the agent controls you're missing.

Article · 4w ago2

Anthropic's AI Broke Out of Its Own Security Tests

Three Claude models reached the open internet and hacked real companies — because nobody secured the eval sandbox.

Article · 4w ago1

The AI hacked real companies because the sandbox had internet

Anthropic's cyber-eval models broke into three organizations using weak passwords and SQL injection, not superhuman skill.

Article · 4w ago5

AI Agents Just Repriced Every Medium-Severity CVE

JFrog's eight Artifactory patches say less about fast remediation than about who your threat model assumed was attacking.

Article · 1mo ago0

A camera login page leaked admin access to Hanwha's GitHub

The culprit is a one-line Vite build footgun that bakes your entire CI environment into shipped code.

Article · 1mo ago5

GitHub Locks 2FA On for Good This September

The September 2 deadline ends three years of soft enforcement and points at GitHub's real target: long-lived tokens.

Article · 1mo ago4

Dependabot's Three-Day Cooldown Is Incomplete

The new default delays routine version PRs, but install paths and package managers still need their own age gates.

Article · 1mo ago1