Tag

#dotnet

2 posts ·all posts

Relatedsecuritysupply-chainnpmpythongojavarustphp
· Jacob Verhoeks

Supply Chain Attacks Hit Every Ecosystem. Here's How to Defend Yours.

A three-layer defense for developers and DevOps engineers: harden your dev machine in 5 minutes, lock down project configs for every ecosystem, and enforce policy org-wide with a proxy. Covers npm, pnpm, yarn, bun, pip, uv, Go, Maven, Gradle, NuGet, Cargo, and Composer — plus escrow, JFrog Curation, and Nexus.

Read
· Jacob Verhoeks

npm install Shouldn't Run Your Code

Supply chain attacks on package registries are surging across every ecosystem. Two controls block the majority: a quarantine window and disabled install scripts. The exact config for npm, pip, Go, Maven, NuGet, Cargo, and more — plus a one-command proxy and shell tests you can run today.

Read