#supply-chain
Wiki 16
- Anubis WASM vendor binary: reproducible builds are surprisingly hard Three ways the compiler broke determinism while vendoring a wasm2js binary for Anubis
- Dependency Vendoring Committing dependency source into your repo as a fire-break against automatic propagation
- Features everyone should steal from npmx Nesbitt catalogs 17 npmx.dev features as a registry-design spec, plus the competitive-pressure effect on npmjs.com
- fsnotify Maintainer Dispute and Supply-Chain Concerns A maintainer-access dispute in fsnotify (321k dependents) read from the outside as a possible takeover; what actually happened, and why governance ambiguity is itself a supply-chain risk
- Hardening container images Mike Cardwell rebuilds the PowerDNS Recursor image as two static binaries on scratch, with Landlock, seccomp, daily rebuilds, SBOM, VEX and cosign
- Hold on to Your Hardware AI data centers are eating global DRAM/NAND/HDD supply, consumer hardware becoming scarce and expensive
- I Do Not Recommend Bitwarden After years of self-hosting, Marius's case against Bitwarden — investor capture, enterprise architecture, security incidents, and a divide-and-conquer credential split as the way forward
- Installing Ruby gems with go get Nesbitt points GOPATH at a Ruby load path — and gets a transparency log RubyGems doesn't have
- Maintainer Governance Ambiguity When a project's maintainer roles and release authority are unclear, downstream users can't distinguish takeover from drama — and have to assume the worse possibility
- Open Source Security at Astral Astral's full supply chain security posture; CI/CD lockdown, Trusted Publishing, Sigstore, cooldowns
- Reproducible Builds Bit-for-bit identical output from the same source, and why compilers keep breaking it
- Reuse Less Software We reuse too much software now; vendor every dependency as a fire-break against supply-chain attacks
- Socket Blog Socket.dev's writeups of npm/PyPI/RubyGems supply-chain incidents and ecosystem-security analysis
- TanStack npm Supply Chain Compromise — Postmortem How three known vulnerabilities chained into 84 malicious @tanstack/* npm publishes, and what stops the same chain
- xz-utils Incident 2024 social-engineering supply-chain attack where a long-running fake-maintainer persona ("Jia Tan") inserted an SSH backdoor into xz/liblzma
- You Don't Want Long-Lived Keys Ludwig's case for ephemeral credentials over rotation, with EC2 Instance Connect, PyPI Trusted Publishers, and SSO as patterns
Toolbox 1
- dockerscan Docker image scanner bundling CIS benchmark, secrets, CVE, supply-chain and runtime checks