Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A compromised tensorlake release on npm stole developer credentials, republished victims' packages and planted a service that wipes the home directory if you revoke the stolen GitHub token.
On 21 September 2026 a stolen git push credential put an Ethereum-based loader into three repositories. Only nub reached npm's pipeline, and publish-time scanning blocked it.
On 5 October 2026 a changed GitHub Actions step swapped SubQuery's built package for a downloaded tarball and published it through trusted publishing. It ran on install and on import.
Two Zammad bugs chained from session hijack to root were used to breach DIVD in September. CISA added both to KEV on 2 October. Fixed in Zammad 7.2.2.
A China-nexus actor exploited a BeyondTrust Remote Support zero-day starting 29 August. Patch BT26-05 is out and the CISA KEV due date is 19 October 2026.
A ransomware attack on IDC Frontier's IDCF Cloud took down East Japan Region 1 on 7 October 2026, hitting 495 companies and local governments. Here is what to check.
An overnight login to the admin site of Scala Communications' i-ask FAQ system exposed inquiry data from up to five client companies, including Daiwa, Citizen and Sompo Japan.
Frontline Education told school districts that a flaw in third-party software it uses led to theft of employee data including Social Security numbers. What districts should check.
ASOS says an attacker posing as a trusted contact got an employee's login, then used it on third-party platforms that message customers. What to check in your own SaaS estate.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
