Supply Chain
In-depth guides and analysis on supply chain from the Safeguard engineering team.
55 articles
Open Source Security Platforms: What They Actually Do
An open source security platform isn't one tool — it's usually a combination of SCA, license scanning, and vulnerability intelligence stitched into a pipeline that watches your dependencies.
GitHub Actions Immutable Actions GA: Why OCI-Backed Action Distribution Closes the tj-actions Class of Attack
GitHub's 2026 roadmap puts Immutable Actions GA at the center of Actions supply-chain hardening, publishing actions as OCI artifacts with hash-mismatch fail-fast and full composite-action visibility.
Software Supply Chain Security News: How to Actually Track It
Software supply chain security news moves across a dozen disconnected sources — registries, CVE feeds, vendor blogs — here's a repeatable system for not missing the one that hits you.
The boltdb-go Backdoor: A Three-Year Go Module Mirror Persistence
A typosquat of boltdb hid a Go module mirror cache-poisoning attack for three years before Socket researchers disclosed it on January 30, 2025.
cross-env and the crossenv Typosquat: A Supply Chain Case Study
In 2017, a malicious crossenv package on npm stole environment variables from developers who mistyped cross-env. The incident is still the cleanest case study in typosquatting we have.
node-pre-gyp and node-gyp: The Security Cost of Native Modules
@mapbox/node-pre-gyp downloads compiled binaries into your node_modules at install time. Understanding that machinery is the difference between a fast install and an unauditable one.
PyPI Malware in 2026: What Changed
PyPI malware today looks less like typosquats and more like AI-assisted campaigns that mimic legitimate maintainers — here's what shifted and how teams are catching it before install.
Supply Chain Vulnerability Protection: A Checklist
A working checklist for supply chain vulnerability protection, from dependency inventory through SBOM generation and continuous re-scanning, built for teams shipping today.
SBOM Full Form and Why It Matters Now
SBOM full form is Software Bill of Materials — a complete inventory of the components in an application. Here's what it actually contains and why it matters today.
SCA in Cyber Security: What It Actually Means
SCA in cyber security stands for software composition analysis — the practice of identifying every open-source component in an application and checking it against known vulnerabilities and licenses.
Trusted Publishing Across Every Major Registry: The 2026 State of OIDC-Backed Publishing
By end of 2025, Trusted Publishing landed on PyPI, RubyGems, npm, crates.io, and NuGet. PyPI alone crossed one million Trusted-Publisher uploads. Here is the defender view of the cross-ecosystem rollout.
Blocking Malicious Packages at the Proxy Level With Artifactory
Once a compromised dependency reaches a laptop or CI runner, you are doing incident response. Blocked at the Artifactory proxy, it is a log line. Here is the configuration that makes that happen.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.