DEV Community

#supplychain

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
xAI publishes Grok Build's source after the coding agent was caught siphoning SSH keys
leobaniak profile
Leo

xAI publishes Grok Build's source after the coding agent was caught siphoning SSH keys

#codingagents #supplychain #security #sshkeys
Comments
3 min read
Mini Shai-Hulud: the tj-actions memory-dump script, reused fourteen months later
eldor_zufarov_1966 profile

Mini Shai-Hulud: the tj-actions memory-dump script, reused fourteen months later

#devsecops #security #supplychain #cicd
Comments
2 min read
The workstation is in scope now
leobaniak profile
Leo

The workstation is in scope now

#supplychain #developerworkstation #githubactions #vscode
Comments
3 min read
Clinejection: How a GitHub Issue Title Compromised an AI Coding Assistant Used by 5M Developers
eldor_zufarov_1966 profile

Clinejection: How a GitHub Issue Title Compromised an AI Coding Assistant Used by 5M Developers

#appsec #supplychain #devsecops #ai
Comments
3 min read
GitLab tries to auto-fix the transitive-dep problem it keeps quantifying
leobaniak profile
Leo

GitLab tries to auto-fix the transitive-dep problem it keeps quantifying

#gitlab #supplychain #dependencies #autoremediation
Comments
5 min read
Cordyceps: when a stranger's pull request runs as a maintainer
leobaniak profile
Leo

Cordyceps: when a stranger's pull request runs as a maintainer

#supplychain #githubactions #workflowsecurity #pullrequesttarget
Comments
3 min read
Crunchyroll Hackeada: 100GB Robados vĂ­a un Empleado de Telus
alejandxr profile

Crunchyroll Hackeada: 100GB Robados vĂ­a un Empleado de Telus

#breach #supplychain #streaming #sony
Comments
5 min read
Inside the Chain: the tj-actions compromise wasn't one incident — it was three
eldor_zufarov_1966 profile

Inside the Chain: the tj-actions compromise wasn't one incident — it was three

#devsecops #security #supplychain #cicd
Comments
2 min read
Booking.com Breach: When the Vendor Chain Becomes the Attack Surface
alejandxr profile

Booking.com Breach: When the Vendor Chain Becomes the Attack Surface

#breach #booking #vendorchain #supplychain
1
Comments
2 min read
Dependabot learns to wait: version-update PRs now sit for three days by default
leobaniak profile
Leo

Dependabot learns to wait: version-update PRs now sit for three days by default

#dependabot #github #supplychain #packageupdates
Comments
4 min read
Datadog says months-long GitHub recon out of dormant 'ghost' accounts is prep for supply-chain attacks
leobaniak profile
Leo

Datadog says months-long GitHub recon out of dormant 'ghost' accounts is prep for supply-chain attacks

#github #supplychain #security #reconnaissance
1
Comments
2 min read
k8s-aibom writes down the AI your cluster is already running
leobaniak profile
Leo

k8s-aibom writes down the AI your cluster is already running

#supplychain #aibom #cyclonedx #kubernetes
1
Comments
3 min read
HalluSquatting: the dependency your agent invented, and the attacker who registered it first
leobaniak profile
Leo

HalluSquatting: the dependency your agent invented, and the attacker who registered it first

#supplychain #aicodingagents #packagehallucination #dependencyscanning
Comments
3 min read
The five-minute SBOM sniff test earns its keep
leobaniak profile
Leo

The five-minute SBOM sniff test earns its keep

#supplychain #sbom #hardenedimages #security
Comments
3 min read
Innersource security advisories go GA: a private channel for private vulns
leobaniak profile
Leo

Innersource security advisories go GA: a private channel for private vulns

#github #ghas #dependabot #supplychain
Comments
3 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.