Open Source Security
event-stream: The Copay Attack That Rewrote npm
The 2018 event-stream incident was npm's first high-profile maintainer-handoff attack. The details still shape how we evaluate package trust.
Jan 1, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIncident Analysis
CCleaner 2017: Anatomy of a Quiet Supply Chain Hit
The CCleaner backdoor of 2017 was among the first modern build-system compromises to achieve mass distribution through a trusted installer.
Jan 1, 20267 min read
Incident Analysis
Equifax: The Supply Chain Angle Few Talked About
The 2017 Equifax breach is a case study in Apache Struts, inherited dependencies, and a vulnerability management process that mistook lists for action.
Jan 1, 20267 min read
Incident Analysis
M.E.Doc and NotPetya: The Origin Story
The forensic detail of how M.E.Doc's update server became the delivery mechanism for NotPetya, and what it means for small-vendor risk.
Jan 1, 20268 min read
Incident Analysis
NotPetya's Origin: A Supply Chain Story From Ukraine
NotPetya is remembered as ransomware. It was not. It was a supply chain wiper that detonated through Ukrainian tax software in June 2017.
Jan 1, 20267 min read
SBOM
Medical device firmware SBOM and coordinated vulnerabilit...
How medical device firmware SBOMs, FDA Section 524B, ISO 81001-5-1, and coordinated vulnerability disclosure work together to secure connected IoMT devices.
Jan 1, 20267 min read
Incident Analysis
WannaCry's Supply Chain Dimensions
WannaCry was not a supply chain attack in the usual sense. Its real supply chain story is EternalBlue, NSA leaks, and the patch cycle.
Jan 1, 20267 min read
Vulnerability Analysis
cross-spawn ReDoS vulnerability (CVE-2024-21538)
CVE-2024-21538 is a ReDoS flaw in the widely-used cross-spawn npm package. Learn the impact, CVSS/EPSS context, and how to remediate it.
Jan 1, 20267 min read
Vulnerability Analysis
Express.js open redirect vulnerability (CVE-2024-29041)
CVE-2024-29041 lets attackers weaponize Express.js redirects for phishing. See affected versions, CVSS/EPSS data, and how to remediate fast.
Jan 1, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.