#supply-chain-security — Public Fediverse posts

Three researchers turned an SBOM into working exploits for ~$0.20 each. And an SBOM is just an ingredients list. Now we're all being pushed to build the weakness list (CBOM). Or as I like to call it, a target list.

At HealthSec last December, researchers took a de-identified SBOM from a real cardiac device. OWASP Dependency-Track returned 45 vulnerabilities. They selected nine, passed each to an LLM for an attack blueprint, built the environments as containers, and ran the exploits. Seven of the nine worked, at ten to thirty minutes of analyst time per cycle.

An SBOM only names components and versions. A cryptographic bill of materials (CBOM) names the algorithm, the key length, the certificate expiry, the internet exposure, the data sensitivity, the vendor who controls the remediation, the system owner, etc. All the cross referencing an attacker might need is already done. By the defender. On a compliance schedule.

Over the last two years I've watched quite a few cyber teams miss the special regime a CBOM should be handled under. Competent people, serious programs, but nobody had told them this output has a bigger blast radius and a longer shelf life than any vulnerability list they've handled before.

Four claims and the evidence, including the one regulator that did say something:

https://postquantum.com/post-quantum/protecting-the-cbom/

#PostQuantum #PQC #CBOM #CISO #Cryptography #SupplyChainSecurity #Infosec #QuantumSecurity

Supply Chain Security in the PHP Ecosystem

https://phpc.tv/w/aqFFdZBJhAb6S7sYoTaofN

🔐 Attending USENIX in Baltimore? Join @steiza tomorrow for:

Supply Chain Attacks on Open Source: What’s Happening, What Can We Do Today, and What’s Next

📅 August 13, 2026
🕟 4:30 PM
📍 Baltimore, MD

#USENIX #OpenSourceSecurity #SupplyChainSecurity

Hey, hey, it's been a long time since the last huge supply chain attack (what about AUR? it's for nerds). NPM Supply Chain Attack returned again, this time infecting more than 444 packages with accumulation of 2B (yeah B for billion) downloads. The malware used is Shai-hulud again, but this time, the culprit is Copycat of TeamPCP.

What should you do?
- Check if you are affected, if so, downgrade your library version
- Rotate your keys and do 2FA
- Search for infected accounts in your system, if there is one, remove it... or kill it with cold blood.

More details:
https://www.ox.security/blog/a-new-infostealer-worm-hits-npm-affecting-keyv-and-cacheable/

#cybersecurity #infosec #security #supplychainsecurity #supplychain #npm#shaihuludmalware

via @dotnet : Strengthening NuGet Supply Chain Security: Reducing API Key Lifetime

https://ift.tt/3IOsjnU
#NuGet #NuGetTrustedPublishing #APITokenSecurity #APIAccessSecurity #APIKeyRotation #OpenIDConnect #OIDC #SecurityNews #SupplyChainSecurity #DevOps #CI/CDSe…

You trust your dependencies? That’s the risk. From #Log4Shell to self-replicating worms, attacks don’t hit your code first — they hit your supply chain, often via packages.

@MohammadAliEN explains what to watch: https://javapro.io/2026/04/23/the-whispering-jar-java-security-lessons-hidden-in-a-fantasy-tale/

#AppSec #Java #SupplyChainSecurity

🎉【COSCUP 開源政策軌 議程集錦！】🎉

🔐【開源也有資安責任——企業治理與供應鏈安全專題】🔐

你知道你部署的每一個容器映像檔，平均預裝了多少個你的應用程式根本用不到的套件嗎？你知道歐盟《網路韌性法》（CRA）的漏洞通報義務即將在 2026 年 9 月生效嗎？
開源不是免費的午餐，它帶來自由，也帶來責任。🌐

今年的開源政策軌，我們邀請到多位講者，從 AI 開源生態、電信雲供應鏈安全到企業開源治理框架，一次講清楚：

▸ From Code Contributor to Industry Power – How Open Source Becomes Taiwan’s AI Strategy
👤 Marie Gigarel（英文議程）
▸ Securing the Open Source Telco Cloud: SBOMs, Supply Chains, and Compliance at Scale
👤 Brian Su + Terry Shih（英文議程）
▸ 從 OpenSSF Scorecard 到 S2C2F，企業內部推動開源治理的實戰框架是什麼？
👤 Ryan Hsieh 謝文豪
▸ 開源是免費的嗎？從 CNCF 大使視角看人才、企業、政策三方困境
👤 梯口 tico88612
▸ 以 CRA 為例討論產品資安合規下的開源議題——法規來了，開源人準備好了嗎？
👤 李婉萍
▸ Your Container Images Are a Liability: The Supply Chain Debt Nobody Is Paying Down
👤 Hrittik Roy + Parth Goswami （英文議程）

📅 8/8~8/9（日）10:00 起
📍 研陽大樓 TR209 教室（二樓）
完整議程：https://coscup.org/2026/track/526

🌟 如果你在企業裡推動開源、負責資安合規、或關心 AI 生態系的未來，這天的場次是為你量身打造的！💬🤝

#COSCUP2026 #OCF #OpenSourcePolicy #開源政策 #OpenSource #SBOM #SupplyChainSecurity #CRA #OpenSSF #S2C2F #CNCF #企業開源 #供應鏈安全 #資安合規 #AI #FOSS #FLOSS #開源人年會 #TechEvent #Taiwan

@hacksilon PS. I like to add more hashtags to make it easier for people to find your post about malicious adform package.

#supplychain #supplychainsecurity #supplychainattack #npm #npmsecurity #ioc

Understanding Verification Methods

https://docs.gradle.org/current/userguide/dependency_verification.html

#gradle #supplychainsecurity

I've been trying to stay quiet about it over vacation, but I'm damned impressed with how #atomdrift is showing up in the malware detection charts. Nothing comes close to it for #supplychainsecurity. Have a question? Leave a comment.

Akrites is the open-source community’s new line of defense against AI-driven attacks. Stronger supply chain security can’t come soon enough. https://jpmellojr.blogspot.com/2026/07/akrites-marshals-open-sourcecommunity.html #AI #Akrites #OpenSource #SupplyChainSecurity #AIsecurity

CI/CD pipelines are a prime target for supply chain attacks. We hardened the GitHub Actions workflows for Composer, Packagist and Private Packagist with zizmor, a static analysis tool for GitHub Actions. 🌈

Our new blog post covers what zizmor catches, our configuration, and the pitfalls we hit along the way:
https://blog.packagist.com/securing-our-github-actions-workflows-with-zizmor/

#php #phpc #composerphp #github #githubactions #supplychainsecurity

OWASP Dependency-Track v5.0.3 released

https://secburg.com/posts/dependency-track-v503-released/

#DependencyTrack #OWASP #SBOM #SupplyChainSecurity #DevSecOps

#HandsOnWorkshop
Adversary Village at @defcon 34!
Michael Chan from @kpmg Canada takes the Adversary Village Workshop Stage with “Vibe Check: How Adversaries Exploit Developer Trust from Malicious Repos to AI Agents” on 8 Aug 2026.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session: https://adversaryvillage.org/adversary-events/DEFCON-34/Michael-Chan/
#AdversaryVillage #DEFCON34
#AdversaryTactics #HandsOnWorkshop #AISecurity #AdversaryTactics
#SupplyChainSecurity #DeveloperSecurity #OffensiveTradecraft