Supply Chain
A package registry token leaked: what should you check and revoke?
Revoke the token, list recent publishes, check who has access and look for new versions you did not release. A checklist for npm and PyPI tokens.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Last commit two years ago: is the dependency abandoned?
An old last commit does not always mean abandoned. Here is how to tell finished software from neglected software, and when to plan a replacement.
Oct 18, 20263 min read
Supply Chain
KEV entries that flag open source components: 77 and counting
CISA notes tie 77 KEV entries to open source, third-party libraries or shared protocols, led by the Linux kernel. What dependency owners should do.
Oct 18, 20264 min read
Supply Chain
How do you keep pinned Docker image digests up to date?
Pinning a digest stops surprise changes but also stops fixes. Automate update pull requests, review them, and rebuild on a schedule so pins stay fresh.
Oct 18, 20263 min read
Supply Chain
Which services use which messaging client library? Build the inventory
When a broker client library has an advisory, you need to know which services ship it. A short method for inventory, ownership and fast triage.
Oct 18, 20263 min read
Supply Chain
How does ISO 27001 5.21 apply to the software you depend on?
How ISO 27001 control 5.21 on the ICT supply chain applies to libraries and software suppliers, and what risk records an auditor expects to see.
Oct 18, 20263 min read
Supply Chain
Is your bundler loader or plugin trusted code in your build?
Bundler loaders run in Node.js with full access to the build machine. Treat each as production code: review it, pin it and limit what the build can reach.
Oct 18, 20264 min read
Supply Chain
How do you confirm you have the official package, not an impostor?
Before you evaluate a library, confirm it is the real one. Check links both ways between docs, repository and registry, and watch for similar names.
Oct 18, 20264 min read
Supply Chain
Is Log4j 1.x safe to use? It has been end of life since 2015
Log4j 1.x reached end of life on 5 August 2015 and known issues will not be fixed. See how to find it hiding in your Java apps and how to replace it.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.