Tag
Dependabot now waits three days before opening version update PRs to reduce risk of supply chain attacks. Security updates remain immediate.
Config files for IDEs, AI coding agents, and package managers can execute code automatically, creating a supply chain security blindspot. The article details the Miasma worm attack that uses such config files to drop malware, and provides examples of injection vectors.
The May 2026 Reproducible Builds report highlights a major Debian policy change requiring all packages to be reproducible for inclusion in the 'forky' release, along with news about a 2026 summit in Gothenburg, a new rebuilderd version, and other project updates.
Bundler 4.0.13 introduces a cooldown feature that blocks resolution to gems published less than N days ago, mitigating supply-chain attacks. It is opt-in and configurable per source, setting, or command-line flag.
A developer created an independent trust registry for 171 open-source AI agents, scoring them on verifiable trust signals like supply chain security and maintenance, finding that only three agents achieved a Grade A rating while many popular agents lacked basic verification.
npm introduces staged publishing, requiring human approval via 2FA for package releases, and new `--allow-*` flags (file, remote, directory) to control install sources, improving supply-chain security in npm CLI 11.15.0.
The article argues that dependency cooldowns unfairly burden developers in earlier time zones and proposes using deterministic phased rollouts based on project identifiers to distribute adoption more equitably.
The article warns that the MCP ecosystem is repeating the same supply chain security pattern seen in npm, Docker, and PyPI, with minimal vetting and growing risks. It highlights that a scan of 500 Smithery servers found 18.8% with security issues and that existing security tooling cannot handle malicious agent instructions, and introduces a new static scanner called bawbel.
The popular Go library fsnotify has raised supply chain security concerns following changes to maintainer access.
This paper introduces Kettle, an attested build system that generates cryptographically verifiable software provenance using Trusted Execution Environments (TEEs). It aims to eliminate the build infrastructure and operators from the trust surface by binding provenance documents directly to hardware-signed attestation reports.
A new npm package called safe-install is introduced to enhance supply chain security by allowing developers to disable install scripts by default and block exotic sub-dependencies, addressing ongoing vulnerabilities.
A developer shares a tip to configure a minimum release age for package installs to mitigate supply-chain attacks.
The article discusses the security breach of LiteLLM and its implications for AI agent engineering teams, highlighting the need for improved supply chain security and infrastructure governance.