Security Tip: Don't let your software supply chain be a black box. 🛡️

Generating a Software Bill of Materials (SBOM) for every release allows your security team to map dependencies against known vulnerabilities in real-time. In the event of a zero-day, an SBOM is the difference between a quick fix and a week of manual searching.

Track the latest threats and vulnerabilities at https://cvedatabase.com

#SBOM #SupplyChainSecurity #CyberSecurity #InfoSec #CVE

Shoutout to our Gold Sponsor CyBeats 💀. Grateful to have them in the Village this year. https://www.cybeats.com/

#AppSecVillage #AppSec #SBOM #SupplyChainSecurity #GoldSponsor #Shoutout

The last weeks have been busy: Here are my slides on Composer & Packagist Supply Chain Security in 2026 from #PHPVerse last week: https://naderman.de/slippy/slides/2026-06-09-PHPVerse-Composer-and-Packagist-Supply-Chain-Security-in-2026.pdf

Thank you to @jetbrains for organizing a fantastic online event with thousands of simultaneous live viewers again! Video recordings will be published soon as well!

Follow https://blog.packagist.com for updates on supply chain security.

#php #phpc #composerphp #supplychainsecurity

Stop the scams. Stop the scammers.

When trust is assumed, abuse spreads — from poisoned packages to compromised supply chains. Let’s build security that enforces boundaries, blocks unauthorized effects, and makes fraud costly before it reaches users.

GitHub: https://github.com/LemonScripter/dcc-shield

#AntiFraud #CyberSecurity #SupplyChainSecurity #ZeroTrust #AUR

China Tightens Grip on Supply-Chain Data

China's new regulations, effective April, are tightening controls on supply-chain data, with a focus on the intent behind data collection, not just what is collected. Authorities can now scrutinize the purpose of investigations and information gathering to ensure they align with Chinese laws and regulations.

https://osintsights.com/china-tightens-grip-on-supply-chain-data?utm_source=mastodon&utm_medium=social

#SupplyChainSecurity #China #NationalSecurity #DataCollection #IndustrialSecurity

Every npm install is a trust decision you make silently — and then ship to real users.

A 3-line helper can pull in dozens of transitive packages, each a maintainer, a build step, and an unreviewed future update. You can't read all of node_modules, but you can read the deps in the paths that touch auth, secrets, money, and user data.

Audit by blast radius, not alphabet. That's the whole move.

#WebDev #SoftwareEngineering #SupplyChainSecurity #BuildInPublic