Back to tags
#supply-chain
every dependency you didn't write, audit, or notice — until one of them notices you.
3 blog posts.
Three posts on the code you shipped but did not write. Part 1 of the Lazy Security series is npm: postinstall scripts, dependency cooldowns, and the install-time defences that refuse malware before bytes hit disk. Part 2 is the same problem one level up — the trivy-action tag rewrite, org-level SHA pinning enforcement, and why a version tag is a name lookup rather than a pin. Part 3 names what partially mitigates the class that survives both: provenance, attestation, and audit logs you can actually read.
Blog posts
Identity, network access, default credentials, attestation, and audit logs: the unsexy DevSecOps controls that close most of the gap Parts 1 and 2 left…
Hardening GitHub Actions for small teams: SHA pinning against tag rewrites, OIDC over long-lived secrets, dependency cooldowns, and the trigger to never…
Startup-grade defense against npm supply-chain attacks, for Future You at 3am. Chainjacking, postinstall scripts, smallest install, most leverage.