Supply Chain
Tabletop script: an npm worm steals developer credentials
A 60 minute tabletop script for a self replicating npm package compromise: injects, roles, and the questions that expose gaps in your response.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Tabletop script: a developer editor extension turns malicious
A 45 minute tabletop script for a popular IDE extension that updates to a malicious version: find installs, contain laptops, rotate secrets and set policy.
Oct 19, 20263 min read
Supply Chain
Tabletop script: your internal package name shows up on npm
A 45 minute tabletop script for dependency confusion: an internal package name appears on a public registry. Scope, containment and registry controls.
Oct 19, 20264 min read
Supply Chain
Tabletop script: a popular GitHub Action turns malicious
A 60 minute tabletop script for a compromised third-party GitHub Action: setup, four injects, discussion questions and what good answers look like.
Oct 19, 20264 min read
Supply Chain
Why do generated Java models pull in swagger annotations?
Generated Java models use Swagger v2 annotations, and v3 annotations do not work as a swap. What that means for your dependency tree and your scanner.
Oct 19, 20263 min read
Supply Chain
Which supply chain security quick wins can a SaaS startup do in a week?
Six supply chain quick wins a small SaaS team can finish in one week: lockfiles, scanning, branch rules, CI permissions and a vendor list.
Oct 19, 20264 min read
Supply Chain
What does a supply chain security program office actually do?
A supply chain risk program office advises, hosts tools and templates, assesses suppliers, keeps the risk register and reports upward. Here is the scope.
Oct 19, 20264 min read
Supply Chain
Which supply chain sections should your postmortem template add?
Add dependency path, exposure window, artifact recall, credential rotation and external source sections to a postmortem template for supply chain events.
Oct 19, 20264 min read
Supply Chain
How should a maintainer write a postmortem after a package compromise?
Maintainers whose package was compromised should publish what happened, which versions are bad, how to check, how to clean up and what changed in access.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.