Blog
Supply Chain SecurityWhat Is a Build Pipeline Compromise?
SolarWinds.Orion.Core.BusinessLayer.dll shipped with a valid SolarWinds Authenticode signature and a backdoor inside the same assembly. The git history was clean. The certificate was the real one.…
2026-06-149 min read
Supply Chain SecurityWhat is CI/CD security?
On 14 and 15 March 2025 the tags v1 through v45.0.7 of tj-actions/changed-files were repointed to commit 0e58ed8. The injected updateFeatures code read secrets out of the runner process and printed…
2026-05-2712 min read
Supply Chain SecurityWhat Is Typosquatting in Package Repositories?
On 19 July 2017 an npm user named hacktask published a package called crossenv. The popular package is cross-env. The squat read the environment variables of whatever machine installed it and sent…
2026-05-2110 min read
Supply Chain SecurityWhat Is Dependency Confusion?
pip install --extra-index-url https://pypi.internal.example.com/simple internal-auth-lib queries two indexes at once. pip's own documentation says what happens next. There is no priority in the…
2026-05-1111 min read
Supply Chain SecurityWhat Is Software Supply Chain Security?
Between July 18 and 19, 2026, four versions of a gem called git_credential_manager landed on rubygems.org in roughly nine hours. Version 2.8.0 was already a working dropper. It built a URL against a…
2026-04-268 min read
Supply Chain SecurityWhat Is a Software Bill of Materials (SBOM)?
The first question after CVE-2021-44228 went public was not how the JNDI lookup works. It was which of our systems ship log4j-core. Most teams answered it with a fleet-wide find / -name "log4j*.jar",…
2026-01-318 min read
Supply Chain SecurityWhat is a supply-chain attack?
SolarWinds.Orion.Core.BusinessLayer.dll carried a valid SolarWinds Authenticode signature. It also carried SUNBURST. A supply-chain attack is an intrusion where the attacker does not compromise the…
2026-01-1911 min read