#supply chain attack prevention
12 related articles
·3 min
GitHub Supply Chain Security Upgrade: A Deep Dive into npm and Actions Defense Mechanisms
GitHub upgrades supply chain defenses for npm and Actions with provenance attestation, least privilege enforcement, and anomaly detection to combat attacks.
Read more →
·3 min
GitHub Supply Chain Security Upgrade: A Deep Dive into npm and Actions Defense Mechanisms
GitHub upgrades supply chain defenses for npm and Actions with provenance attestation, least privilege principles, and anomaly detection across multiple layers.
Read more →
·3 min
Automating GitHub Releases: Design and Practice of a Tag-Triggered Release Action
A ten-year open source maintainer shares how to build a universal tag-to-release GitHub Action, covering its opinionated design philosophy, dogfooding validation, and AI-assisted development.
Read more →
·6 min
AI Agent Security in Practice: 7 Attack Techniques and a Five-Layer Defense System
An in-depth breakdown of the 7 major attack techniques against AI agents (prompt injection, data poisoning, image attacks, etc.) and a five-layer defense system, with real cases from Doubao and DeepSeek.
Read more →
·5 min
Ransomware Negotiator Turns Insider: Third Conviction for Colluding with Hackers to Extort Businesses
A Florida ransomware negotiator was convicted for secretly colluding with hackers to extort US businesses—the third such conviction. Learn how insider negotiators operate and how firms can defend themselves.
Read more →
·4 min
AI Coding Security: A CLI Tool Designed to Block Vulnerable Dependencies for Agents
AI coding assistants (Copilot/Cursor/Claude Code) frequently introduce vulnerable dependencies and hallucinate package names. This post analyzes an Agent-native CLI security tool and the shift-left security philosophy for AI-era supply chains.
Read more →
·7 min
In-Depth Analysis of the GitLost Vulnerability: How GitHub AI Agents Were Tricked into Leaking Private Repositories
Security researchers disclose the GitLost attack, which uses prompt injection to trick GitHub AI agents into leaking private repository source code. An in-depth analysis of the attack principle, AI agent security risks, and developer defense recommendations.
Read more →
·6 min
Alibaba Bans Claude Code: The Enterprise Security Red Line for AI Coding Tools
In-depth analysis of Alibaba's comprehensive internal ban on Claude Code: from the hidden-marker controversy and Anthropic's regional-restriction stance to five core questions of enterprise AI coding tool security admission.
Read more →
·5 min
Anthropic Updates Cybersecurity Safeguards: How AI Safety Governance Balances Security and Usability
Anthropic updates AI cybersecurity safeguards after U.S. government dialogue. New measures slightly raise false positive rates, with flagged requests downgraded to Opus 4.8 responses. Deep analysis of the security-usability balance in AI governance.
Read more →
6 Free GitHub Security Settings Every …
·4 min
6 Free GitHub Security Settings Every Maintainer Should Enable
GitHub offers 6 free security settings for open source maintainers: 2FA, Dependabot alerts, secret scanning, branch protection, permission reviews, and code scanning. Configure once, benefit long-term.
Read more →
·2 min
When AI Can Find Vulnerabilities, the Privileged Era of Security Research Is Over
Cryptography expert Filippo Valsorda argues LLMs are drastically lowering the barrier to vulnerability discovery, disrupting coordinated disclosure and reshaping the security ecosystem.
Read more →
Tech Frontiers·3 min
Canvas Parent Company Caves to Hackers: The Full Story Behind the 3.5TB Student Data Breach Crisis
Canvas parent company Instructure confirms agreement with ShinyHunters hackers to prevent 3.5TB student data leak. Analysis of ransom controversies, edtech security gaps, and education data risks.
Read more →