software supply chain
"These emails implored OpenJS to take action to update one of its popular JavaScript projects to ‘address any critical vulnerabilities'"
Poisoned Easter eggs for all: Apparent supply chain attack caught mercifully early…
"Package managers are at a critical point in the open source ecosystem and have the capability to scale security improvements across open source ecosystems"
SolarWinds’ poor controls... false and misleading statements and omissions, and the other misconduct... would have violated the federal securities laws even if SolarWinds had not experienced a major, targeted cybersecurity attack"
With tips on securing your own build processes and supply chain resilience...
A highly practical framework to boost the security of open source consumption