Software Supply Chain Security
In-depth guides and analysis on software supply chain security from the Safeguard engineering team.
178 articles
Automating Typosquatting Detection for Package Registries
Typosquatting remains one of the most effective supply chain attacks. Automated detection using string distance algorithms, behavioral analysis, and registry monitoring can catch malicious packages before they reach your builds.
Maven Dependency Resolution Attacks: Exploiting Java's Build System
Maven's dependency resolution mechanism can be exploited through repository poisoning, dependency confusion, and POM manipulation. Here is what Java teams need to know.
Detecting Model Supply Chain Poisoning in 2026
Poisoning attacks against the model supply chain have moved from research to incident reports. What detection looks like when the attack surface includes weights.
Symlink Attacks in Package Managers: Following Links to Trouble
Symbolic links in package archives can redirect file operations to unintended locations. Here is how this old trick still works against modern tools.
What is Software Supply Chain Risk Scoring
CVSS alone can't tell you what to fix first. Here's how supply chain risk scoring blends exploitability, reachability, and provenance into one actionable number.
Cargo Build Script Security: What build.rs Can Do to Your Machine
Rust build scripts run arbitrary code during compilation. Here is what they can access and how to evaluate the risk in your dependency tree.
What is a Malicious Commit / Compromised Maintainer Account
When an attacker steals a maintainer's credentials, every user of that package inherits the compromise. Here's how it happens and how to catch it.
Software Supply Chain Forensics: Investigation Techniques After a Compromise
When a supply chain compromise is confirmed or suspected, forensic investigation must trace the attack path through dependencies, build systems, and artifacts. This guide covers the methodology.
Rust Adoption in Security-Critical Software: Where We Stand
Rust promises memory safety without garbage collection. Here is an honest look at where adoption stands and what it means for supply chain security.
Software Update Signing and Verification: Getting It Right
Signed updates are table stakes for software distribution. But the signing and verification process has pitfalls that undermine the entire security model.
PyPI Namespace Squatting: How Attackers Exploit Python's Flat Package Namespace
Python's package registry has no namespace protection. Attackers exploit this with typosquatting, namespace confusion, and abandoned name reclamation. Here is how to protect your Python supply chain.
Brand Protection on Package Registries: Defending Your Namespace
Attackers impersonate legitimate organizations on package registries through name squatting, logo theft, and metadata manipulation. Here is how to protect your brand and your users.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.