Open Source Security
event-stream: The Copay Attack That Rewrote npm
The 2018 event-stream incident was npm's first high-profile maintainer-handoff attack. The details still shape how we evaluate package trust.
Nov 27, 20186 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
The 2018 event-stream incident was npm's first high-profile maintainer-handoff attack. The details still shape how we evaluate package trust.
The CCleaner backdoor of 2017 was among the first modern build-system compromises to achieve mass distribution through a trusted installer.
The 2017 Equifax breach is a case study in Apache Struts, inherited dependencies, and a vulnerability management process that mistook lists for action.
The forensic detail of how M.E.Doc's update server became the delivery mechanism for NotPetya, and what it means for small-vendor risk.
NotPetya is remembered as ransomware. It was not. It was a supply chain wiper that detonated through Ukrainian tax software in June 2017.
WannaCry was not a supply chain attack in the usual sense. Its real supply chain story is EternalBlue, NSA leaks, and the patch cycle.
Weekly insights on software supply chain security, delivered to your inbox.