supply-chain-security
Latest stories covering supply-chain-security, with summaries and links to related coverage.
3 articles · page 1 of 1
Connected topics
Config Files That Run Code: Supply Chain Security Blindspot
research
10 min read
Config files in repositories can execute code automatically when opened by development tools, potentially allowing attackers to run malicious code without the developer's awareness. Tools such as VS Code, Cursor, Claude Code, Gemini CLI, npm, Composer, and Bundler can read and act on these config files.
The Vercel breach: OAuth attack exposes risk in platform environment variables
research
33 min read
A recent OAuth supply chain attack at Vercel revealed vulnerabilities in platform environment variables and trusted third-party applications, allowing attackers to bypass traditional security measures. The incident highlights significant risks associated with modern Platform as a Service (PaaS) and software supply chains.
Supply chain nightmare: How Rust will be attacked and what we can do to mitigate
opinion
1 min read
Rust is vulnerable to supply chain attacks due to its reliance on third-party crates and libraries. Mitigation strategies include improving dependency management and enhancing security practices within the Rust ecosystem.