SecureChain for Open Source Software

Key Takeaways A version bump is not a patch, and dependency upgrades can introduce potentially breaking changes. Forced upgrades can fail loudly at build time or introduce subtler runtime regressions...

Key Takeaways Go module hashes cover file names and contents, not zip encoding, so an independently rebuilt archive can match exactly. Because of that, pointing GOPROXY at a screened registry...

The Short Version Jump to the Long Version ↓ What: On August 20, 2026, an attacker used a legitimate maintainer’s crates.io account to publish malicious versions of arrayref 0.3.10, append-only-vec...

Key Takeaways A Go module proxy is built to serve files, not to judge whether those files are safe to run. One character in your GOPROXY string decides whether a...

Key Takeaways Go identifies a package by where it lives rather than by a name someone owns, so a lapsed GitHub username can turn into a supply chain problem on...

Key Takeaways A private PyPI repository answers where packages come from, not whether they are safe to install. Adding –extra-index-url instead of pointing –index-url at one index reopens the hole...

Key Takeaways PHP publishes end of life dates years ahead, while Composer packages announce nothing when a maintainer stops showing up. An abandoned dependency is often the reason a PHP...

Key Takeaways Hades shipped .pth startup hooks, so the payload fired every time Python started rather than once at install. The same trick had already shipped inside LiteLLM eleven weeks...

Key Takeaways The malicious axios versions were live for only about three hours, so installs that happened before detection got no help from advisory-driven defenses. Download counts measure adoption, not...

Key Takeaways Six confirmed supply chain campaigns hit npm, PyPI, Go modules and Packagist between March and July 2026. None of them needed a bug in anyone’s application code, just...

Key Takeaways Most software supply chain security tools tell you what already made it into your build, and far fewer stop it from getting there in the first place. The...