Supply chain security
Vendor-neutral coverage of supply chain security.
Articles
19 articlesThe sandbox you thought was closed
The New Stack uses a July 16 intrusion at Hugging Face to name a security category that has been forming for a year: an AI agent breaking out of its containment. For CI/CD teams giving agents build-time access, the sandbox is one control, not the whole boundary.
Aug 25, 2026 · Tomás VegaSupply-chain securityisolated-vm ships a sandbox escape, and the migration story catches up with itself
A type-confusion bug in isolated-vm's ExternalCopy transferList lets sandboxed JavaScript hijack the host process. The library that inherited vm2's job now inherits its threat model too.
Aug 21, 2026 · Tomás VegaSupply-chain securityDocker argues AI agent security is a systems problem, not a review problem
A Docker blog post citing an OpenAI/Hugging Face incident with 17,600 attacker actions says human review can't scale to agent-speed CI, and calls for controls that constrain, observe and govern agents at machine speed.
Aug 20, 2026 · Tomás VegaSupply chain securityThe command your agent approved is not the command that ran
A Docker write-up walks through CVE-2026-22708, a Cursor flaw where shell built-ins slipped past the agent's allowlist and quietly rewrote the environment, turning an approved git branch into arbitrary code execution. Docker's answer is to sandbox the whole agent, which shrinks the blast radius without closing every hole.
Aug 18, 2026 · Tomás VegaSupply chain securityUnsigned images meet an autonomous puller. What could go wrong.
The New Stack argues unsigned container images have always been a risk and become a bigger one when the puller is an AI agent with no human in the loop. The fix, image signing, has been on the shelf for years.
Aug 16, 2026 · Tomás VegaSupply chain securityA shared agent-plugin format is a shared supply chain
OpenAI, AWS, Cursor, GitHub and Microsoft have jointly backed Agent Plugins 1.0.0, a portable package format for reusable AI-agent components. Once the same artifact runs in every vendor's agent, provenance stops being a single-runtime problem.
Aug 11, 2026 · Tomás VegaSupply-chain securityRapidFort points its hardened open-source business at what actually runs in production
At Black Hat USA, RapidFort announced RapidFort Runtime, a read-only monitor for the production environments that consume its curated open-source packages. For CI/CD teams the pitch targets the long-standing measurement gap between what a pipeline shipped and what is executing in the cluster.
Aug 10, 2026 · Maya OkonkwoSupply chain securityImage verification, one layer below admission
A CNCF post outlines a Node Resource Interface plugin that verifies SLSA, VEX and VSA attestations at CreateContainer time inside the container runtime, closing gaps that admission webhooks can miss.
Jul 31, 2026 · Tomás VegaSupply chain securityGitLab tries to auto-fix the transitive-dep problem it keeps quantifying
GitLab has moved Dependency Scanning Auto-Remediation into beta, aimed squarely at the transitive supply-chain risk it just spent a research cycle measuring. The interesting question is not whether the fix ships, but whether anyone downstream trusts the bot enough to merge it.
Jul 17, 2026 · Tomás VegaSupply-chain securityCordyceps: when a stranger's pull request runs as a maintainer
Researchers at Novee catalogue Cordyceps, a class of CI/CD supply-chain exploit where pull requests and comments from untrusted contributors get executed with maintainer permissions. A scan of 30,000 high-impact repositories flagged 654 candidates and confirmed over 300 as fully exploitable, with named blast radius inside Microsoft, Google, Apache and Cloudflare.
Jul 16, 2026 · Tomás VegaSupply chain securityDependabot learns to wait: version-update PRs now sit for three days by default
GitHub is flipping Dependabot version updates to a default three-day package cooldown. A new release has to sit on its registry for at least three days before Dependabot will open a version-update PR; security updates are exempt and still open immediately.
Jul 15, 2026 · Tomás VegaSupply-chain securityThe five-minute SBOM sniff test earns its keep
A quick, deliberate look at the bill of materials for a hardened image catches supply-chain trouble a CVE scanner will never flag. Bolt it into the pipeline, not the compliance report.
Jul 13, 2026 · Tomás VegaSupply-chain securityHalluSquatting: the dependency your agent invented, and the attacker who registered it first
Researchers from Tel Aviv University, the Technion, and Intuit describe a supply-chain pattern, HalluSquatting, that turns an AI coding agent's tendency to hallucinate package and repository names into a delivery channel for remote code execution and botnet payloads. The novelty is in the delivery, not the malware.
Jul 13, 2026 · Tomás VegaSupply-chain securityInnersource security advisories go GA: a private channel for private vulns
GitHub Advanced Security now lets enterprise customers publish security advisories that stay inside the enterprise, and Dependabot picks them up like it would a public CVE. Useful, narrow, and only as good as the discipline behind it.
Jul 11, 2026 · Tomás VegaSupply chain securitynpm v12 flips install-time to closed-by-default
npm v12 shipped as latest on July 8, 2026, with lifecycle scripts, git-URL dependencies and remote-URL dependencies all off by default at install time. Alongside it, the 2FA-bypass Granular Access Token starts a two-step retirement that ends direct publishes.
Jul 9, 2026 · Tomás VegaSupply-chain securityPolinRider keeps expanding, and the postinstall still lands on your runner
DevOps.com reports two DPRK-linked groups are expanding PolinRider, a supply-chain campaign that pushes malicious packages into developer workflows through long-running fake-interview scams. Socket and Rescana are named as the vendors doing the attribution. The pipeline lesson is old, and unfinished.
Jul 8, 2026 · Tomás VegaSupply-chain securityCordyceps and the pipeline attack surface we keep ignoring
Novee Security disclosed a CI/CD flaw pattern, Cordyceps, that an unauthenticated actor can use to plant self-propagating triggers across pipelines. The specifics matter less than the shape: pipelines keep landing on the attack surface, and organizations keep treating them like build tools.
Jul 2, 2026 · Tomás VegaSupply-chain securityAikido buys Root to patch open source in place, without the upgrade dance
Aikido Security acquired Root, a company whose technology fixes known vulnerabilities directly inside the package version you already run. The trade-off: someone other than upstream now decides what your dependency looks like on disk.
Jul 1, 2026 · Tomás VegaSupply chain securitynpm freezes high-impact maintainer accounts for 72 hours after a sensitive change
npm now puts its 'high-impact' maintainer accounts into a 72-hour read-only state whenever it detects a sensitive account change like an email update or 2FA recovery code use. Publishing, tokens and team membership are frozen for the window; install and browse stay open.
Jun 26, 2026 · Tomás Vega