Supply Chain
npm vs PyPI trusted publishing: how the two differ
Both npm and PyPI trusted publishing swap long-lived tokens for short-lived OIDC credentials. Compare providers, requirements, expiry and provenance.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
npm unpublish rules: what happens when a bad package is pulled
npm limits who can unpublish and when, and a removed version number can never be reused. Learn what that means for pinned installs and malicious releases.
Oct 18, 20263 min read
Supply Chain
Do npm scopes stop dependency confusion and name collisions?
Scopes give each user or organization its own npm namespace, preventing name collisions. Learn to use them for internal packages and where they fall short.
Oct 18, 20263 min read
Supply Chain
Securing npm maintainer accounts: 2FA, tokens and trusted publishing
A stolen maintainer account can publish malware to every user. What GitHub announced for npm in 2025 on 2FA, token lifetimes and trusted publishing.
Oct 18, 20263 min read
Supply Chain
npm incident history, from left-pad in 2016 to worms in 2025
A dated list of npm security incidents from one reference article, from left-pad to self-spreading worms, and what each says about registry risk.
Oct 18, 20263 min read
Supply Chain
NIST SP 800-161 for small teams: what to take from it
NIST SP 800-161 covers cybersecurity supply chain risk management. See what it is, why it looks big, and the small set of ideas a small team can use.
Oct 18, 20263 min read
Supply Chain
NIS2 supplier contracts: a clause checklist for security terms
A checklist of security clauses for supplier contracts under NIS2 supply chain security, based on the EU implementing regulation for digital entities.
Oct 18, 20263 min read
Supply Chain
Multi-arch images: which digest do you pin, the index or the platform?
A multi-arch tag points to an index of per-platform images. Pin the index digest for portability or a platform digest for exactness. How to choose.
Oct 18, 20264 min read
Supply Chain
Mod and plugin safety: running community code without regret
Mods and plugins are code from strangers. Decide your trust model, sandbox what runs, review what you host and give players clear signals.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.