Software Supply Chain
In-depth guides and analysis on software supply chain from the Safeguard engineering team.
100 articles
A supply chain security program for open source maintainers from zero
Start a maintainer security program in a weekend: protect the default branch, publish without long lived tokens, pin build inputs, and offer a report path.
What are OCI artifacts and how do you secure them?
OCI artifacts let a registry hold SBOMs, signatures and charts using the image manifest. Secure them with digests, signature checks and scoped writes.
How do you defend NuGet builds against typosquatting and confusion?
NuGet tries every configured source by default. Map each package ID to one source, verify signatures and review new names to stop confusion and typosquats.
How do you respond to a malicious NuGet package?
If a malicious NuGet package reached your build, find it, contain it, rotate secrets, then use source mapping and central versions so it cannot recur.
How do you vet a NuGet package before you install it?
Check the ID prefix, owner and signature, audit for known flaws, map package sources and see why a transitive package is in your graph before you install.
What are ten npm security practices every team should follow?
Ten npm habits that cut supply chain risk: lockfiles, npm ci, audit, install scripts, 2FA, provenance, scoped tokens, pinned CI actions, fewer packages.
What npm security practices matter after the Shai-Hulud worm?
The 2025 Shai-Hulud worm spread through stolen npm credentials. Lock installs, block install scripts, harden publisher accounts and know your dependencies.
Can an npm lockfile hide a malicious package?
Lockfiles make installs repeatable, but they are rarely reviewed. A changed resolved URL or integrity value can slip through a diff. Here is what to check.
How do you vet an npm package before you install it?
Check what a package runs at install, who publishes it, whether provenance verifies and what it pulls in. A short pre-install routine you can finish fast.
What are the licensing and security risks of using Node.js?
Node.js is under an MIT style license, so the real risks sit in bundled components, npm packages and patch discipline. Here is what to check.
Nine lessons from recent software supply chain incidents
Nine practical lessons drawn from 3CX, Log4Shell, xz, axios and LiteLLM, each tied to a primary source and one action you can take this week.
How do you secure a model supply chain: weights, data and provenance?
Treat model weights and datasets as dependencies. Prefer safe formats, pin by hash, record provenance, scan before loading and run unknown artifacts in isolation.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.