devops.com resources

devops.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-07-27.

Date Added	Resource	Excerpt
2026-07-27 2026	GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks Supply Chain	Library for application security that introduces time-based defenses against software supply chain attacks. GitHub's Dependabot now defaults to a three-day cooldown before opening pull requests for routine version updates, and PyPI restricts new files from being added to releases older than 14 days. These changes provide crucial time for maintainers and scanners to detect and mitigate malicious releases, complementing practices like using lockfiles, tightly scoped tokens, and human review.
2026-07-22 2026	Signed Attested and Malicious: The Software Supply Chain Has a Deepfake Problem Supply Chain	Library for detecting software supply chain "deepfakes," where malicious packages present legitimate SLSA provenance and signatures, making them indistinguishable to traditional scanners. This library focuses on behavioral analysis of package installation hooks, network calls, and version changes, alongside account activity monitoring, to identify anomalies like rapid, large-scale publishing or unexpected package behavior. It advocates for a control point between registries and developer machines, holding packages for examination before they enter the build process, and treating new versions with a holding period, as pioneered by efforts to combat worms like Miasma and Shai-Hulud.
2026-06-22 2026	Homebrew to Packages: No ID No Service Supply Chain	Library update details Homebrew 6.0.0's new supply-chain security measures, which mimic npm's approach by requiring explicit user trust for third-party repositories and blocking untrusted installation scripts. This includes a "Guestlist" of pre-approved remote URLs and a `trusted` flag for state management, alongside Bubblewrap integration for sandboxing builds on Linux. Package maintainers and CI/CD pipelines may need to update installation instructions and scripts.
2026-05-22 2026	Attackers Can Exploit a Claude Code RCE Flaw to Take Command of System RCE	Library for securing developer models, this entry details a critical RCE vulnerability in Anthropic's Claude Code (version 2.1.118). Attackers could exploit a parsing flaw in the `eagerParseCliFlag` function via crafted deeplinks to inject arbitrary commands, bypassing trust prompts and taking control of a victim's system. The vulnerability was discovered by Joernchen of 0day.click and has since been patched.
2026-04-21 2026	Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable Supply Chain	Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable https://ift.tt/nvuCc9x