Layered defenses against software supply chain attacks

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

Software supply chain attacks target the dependencies, build systems, and publishing pipelines that produce the software we run, instead of the application itself. A single compromised package can reach millions of systems before anyone notices, and once it lands, it runs with the same trust and privileges as the rest of your code. The diagram below shows where these attacks typically land along…

Read on prefetch.net ↗