#slsa
Tagged “slsa”
2 articlesSecurity & supply chain
The npm worm that shipped with valid SLSA provenance
A DevOps.com analysis of the Miasma npm worm makes an uncomfortable case: signing and provenance told the honest truth, and the pipeline still shipped malware. When the build platform itself is the attack surface, a green attestation is a description of the failure, not a defence against it.
Jul 22, 2026 · Tomás VegaSecurity & supply chainSBOM attestation is becoming a default pipeline step
Generating and signing a software bill of materials at build time is shifting from compliance nice-to-have to standard CD hygiene. Here's the minimal viable setup.
Jun 12, 2026 · Tomás Vega