Supply Chain
In-depth guides and analysis on supply chain from the Safeguard engineering team.
55 articles
The boltdb-go Backdoor: A Three-Year Go Module Mirror Persistence
A typosquat of boltdb hid a Go module mirror cache-poisoning attack for three years before Socket researchers disclosed it on January 30, 2025.
cross-env and the crossenv Typosquat: A Supply Chain Case Study
In 2017, a malicious crossenv package on npm stole environment variables from developers who mistyped cross-env. The incident is still the cleanest case study in typosquatting we have.
node-pre-gyp and node-gyp: The Security Cost of Native Modules
@mapbox/node-pre-gyp downloads compiled binaries into your node_modules at install time. Understanding that machinery is the difference between a fast install and an unauditable one.
SBOM Full Form and Why It Matters Now
SBOM full form is Software Bill of Materials — a complete inventory of the components in an application. Here's what it actually contains and why it matters today.
SCA in Cyber Security: What It Actually Means
SCA in cyber security stands for software composition analysis — the practice of identifying every open-source component in an application and checking it against known vulnerabilities and licenses.
What Does SCA Stand For, and Why Does It Matter Now?
SCA stands for software composition analysis, and it matters more in 2024 than it did five years ago because open source now makes up the majority of most codebases.
SCA Meaning and Full Form: Software Composition Analysis Explained
SCA stands for Software Composition Analysis — the practice of scanning your dependencies for known vulnerabilities and license risk. Here's the full form and how it actually works.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.