Incident Analysis
Lottie Player npm Supply Chain Attack Explained
A leaked maintainer token published three trojanized versions of @lottiefiles/lottie-player to npm, targeting wallet drains. Here is the mechanics.
Jan 19, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainer Security
Continuous container vulnerability scanning with Amazon I...
How Amazon Inspector's continuous container scanning actually works, where Inspector vs Trivy differs, and the ECR blind spots teams need to cover.
Jan 19, 20267 min read
Supply Chain Attacks
LastPass Second Breach: Encrypted Vaults Stolen Using Data from First Attack
LastPass revealed that the August breach enabled a second attack that exfiltrated encrypted customer vaults. The full scope of the damage was devastating.
Jan 18, 20266 min read
Vulnerability Management
Vulnerability Correlation Across Package Ecosystems
The same vulnerability often appears under different identifiers across npm, PyPI, Maven, and other ecosystems. Here is how to correlate vulnerabilities across ecosystems and why it matters.
Jan 18, 20266 min read
Industry Guides
Startup Security Budget Allocation: Where to Spend First
Startups can't afford to do everything at once. Here's how to allocate your security budget for maximum impact, including software supply chain basics.
Jan 18, 20267 min read
Open Source
The Open Source Maintainer Burnout Crisis and Its Security Consequences
Burned-out maintainers abandon projects, accept risky PRs without review, and hand off keys to strangers. The burnout crisis is a supply chain security crisis.
Jan 18, 20266 min read
Container Security
Docker Desktop WSL2 Security Changes in 2022
Docker Desktop's WSL2 backend reshaped container security on Windows. Here is what changed in 2022 and the defects that forced those changes.
Jan 18, 20266 min read
Dependency Security
Python Package Security Best Practices
Practical techniques for securing your Python supply chain, from pip and PyPI to virtual environments and hash verification.
Jan 18, 20265 min read
Cloud Security
AWS ECR Container Scanning: Beyond the Defaults
A deep dive into ECR scanning options, from basic Clair scanning to enhanced Inspector integration, and what most teams get wrong.
Jan 18, 20268 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.