Category
Open-source, CI/CD and dependency attacks, and how to stop them.
GitHub Package Firewall brings install-time npm policy gates, SLSA attestation checks, and version cooldowns to AI coding agents and CI/CD runners.
actions-cool/issues-helper and maintain-one-comment were re-enabled Sept 16 with malicious tags intact, re-exposing ~15K repos. Learn SHA-pinning fix.
Think you may be compromised by LiteLLM? Learn which LiteLLM versions were malicious, how to use the CloudSEK lookup, what to check, and which credentials to rotate.
Explore the evolution of supply chain attacks in 2026. Discover how the Miasma worm bypasses SLSA Level 3, targets AI coding agents, and fuels the Developer Credential Economy.
What is a supply chain attack? Discover how hackers exploit third-party dependencies, bypass traditional security, and how to defend your infrastructure today.
GitHub actions/checkout v7 now blocks pwn request attacks by default. Learn how the pull_request_target exploit worked, what changes, and what supply chain gaps remain.
Prevent the Megalodon supply chain attack. Learn how threat actors injected 5,718 malicious GitHub Actions workflows to steal OIDC tokens and cloud credentials.
Prevent the durabletask PyPI compromise. Learn how TeamPCPs rope.pyz malware steals cloud credentials, propagates via SSM, and how to remediate.
TeamPCP's supply chain attack infected 170+ npm and PyPI packages like TanStack. Learn how the Mini Shai-Hulud worm bypasses SLSA and how to stop its wiper.
pnpm 11.0 is here with critical security defaults. Learn how 'minimumReleaseAge' and 'blockExoticSubdeps' protect your SDLC from immediate supply chain threats.
Master the OWASP Top 10 CI/CD Security Risks. Concrete attacks, code examples, and battle-tested controls to harden your pipelines against supply chain threats.
Traditional security frameworks don't map the modern software supply chain. Discover SITF, the new open-source SDLC Infrastructure Threat Framework by Wiz, designed to visualize, analyze, and prevent complex supply chain attacks.
Looking for something specific?
Search every article by topic, tool or CVE.