Open Source Security
node-tar Arbitrary File Write via Symlink Extraction (CVE...
CVE-2021-32803 allows crafted symlinks in tar archives to make node-tar write files outside the extraction directory via malicious npm packages.
Jul 28, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Analysis
Python Pickle deserialization risk explained
Pickle deserialization lets attacker-controlled data execute arbitrary code on load. Here's how the exploit works, real CVEs, and how to fix it.
Jul 28, 20267 min read
Software Supply Chain Security
Every Supply Chain Attack of June and July 2026 Was After the Same Thing
Nine incidents in eight weeks: a PyPI worm, typosquatted payment SDKs, jscrambler, AsyncAPI, Hugging Face, Polymarket, Nx Console, Medtronic, AdaptHealth. Nine different vectors, one prize — credentials sitting in developer environments and build pipelines. If you fix one thing this quarter, fix that.
Jul 28, 20268 min read
Compliance
Medtronic and AdaptHealth: The Third Party Was the Vulnerability
3.8 million people notified by Medtronic. PII, PHI and insurance billing credentials exfiltrated at AdaptHealth after social engineering against a third-party contractor. Neither breach needed a software vulnerability — both needed a trusted outsider with a session.
Jul 28, 20266 min read
DevSecOps
Eighteen Minutes: The Nx Console Extension Compromise and the IDE Blind Spot
A poisoned VS Code extension was live for eighteen minutes. In that window, auto-update pushed it into every developer environment with Nx Console installed — including a GitHub employee's device, leading to exfiltration of internal GitHub repositories. Your IDE extensions have no SBOM, no review, and a direct push channel to your engineers.
Jul 28, 20266 min read
Open Source Security
node-tar Second Bypass Enabling Arbitrary File Write (CVE...
CVE-2021-32804 let crafted tar archives bypass node-tar path sanitization, enabling arbitrary file writes during npm package extraction.
Jul 28, 20267 min read
Application Security
Polymarket Lost ~$3M Without a Single Smart Contract Bug
On 25–26 June 2026 attackers compromised a third-party vendor and injected malicious code into Polymarket's website frontend, manipulating users into approving fraudulent transactions. Roughly $3M in crypto drained. The smart contracts were never touched. Your client-side dependency tree is production.
Jul 28, 20266 min read
Open Source Security
Python's .pth Files Are a Code Execution Primitive, and Attackers Noticed
The June 2026 PyPI worm wave used a *-setup.pth file to execute at interpreter startup — before your code, before your imports, on every single python invocation. It then fetched the Bun JavaScript runtime to run its payload. If your supply chain model stops at setup.py, it has a hole in it.
Jul 28, 20267 min read
Company
We're Opening Our Channel and White-Label Partner Program Worldwide
Resell it, distribute it, co-sell it, or put your own name on it. Safeguard's partner program is now open in every market outside India and the Middle East — here's how the eight tracks work, what the economics look like, and what we actually expect from a partner.
Jul 28, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.