sbom
Safeguard articles tagged "sbom" — guides, analysis, and best practices for software supply chain and application security.
100 articles
npm package aliasing: the dependency confusion attack surface most teams never scan
npm's alias@npm:target syntax lets an attacker capture a name that doesn't even exist yet on the registry — widening dependency confusion past simple squatting.
OCI Image Labels and Annotations: A Practical Guide to Provenance and SBOM Linkage
OCI defines 14 standard org.opencontainers.image.* annotation keys, but labels are unsigned metadata — anyone with build access can forge them.
Cargo crate vulnerability trends report
RustSec advisories rose 38% year-over-year as crates.io passed 195,000 packages. A breakdown of where Cargo's supply-chain risk is concentrated in 2026.
The GPLv3 License Explained: Compliance and Risk
The GPLv3 license is a strong copyleft license that carries real obligations, and treating it as just another dependency is how companies end up with compliance and legal exposure.
Rust supply chain security landscape
Rust's crates.io has topped 170,000 packages and real attacks are following. Here's what's changed and how security teams should respond.
npm supply-chain attacks: typosquatting, dependency confusion, and postinstall malware
event-stream hid a wallet-stealing payload behind 8M downloads in 2018. Here's how typosquatting and dependency confusion actually work, and how to stop them.
Building an OSPO security governance model for license and vulnerability risk
77% of large organizations now run an OSPO, and 91% say it owns security issues — but most still track license and CVE risk in separate spreadsheets.
Swift Package Manager vulnerability trends
Typosquats, thin CVE coverage, and an executable manifest format: inside the Swift Package Manager vulnerability trends security teams can't ignore.
Introducing Safeguard Academy: Free Courses and Certifications for Supply Chain Security
We're launching Safeguard Academy — a free learning platform at academy.safeguard.sh with curated courses, an AI tutor in every course, course communities, live sessions, and publicly verifiable certifications. The first credential is the Safeguard Certified Practitioner.
Malicious iOS SDKs and CocoaPods report
CocoaPods trunk server CVEs and the SourMint SDK scandal reveal how malicious iOS SDKs and pods slip past App Review for years.
Mobile app dependency vulnerability trends
Mobile apps now ship more third-party code than first-party. Safeguard's analysis breaks down where dependency vulnerabilities cluster and why.
A four-surface framework for software supply-chain risk
Supply-chain attacks are up 650% year over year, per the SLSA framework — yet most teams still map risk to one surface instead of four.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.