GUIDE · 7 min read

Software Supply Chain Attacks: A Defender's Guide

The last two years made one thing clear: your dependencies are your attack surface. Here's the defender's playbook for npm, PyPI, Go modules and containers.

Know what you ship

Generate an SBOM on every build (CycloneDX or SPDX). You can't defend what you can't inventory.

Pin and verify

Lockfiles + integrity hashes + signature verification (Sigstore/cosign). Reject anything unsigned or unpinned in CI.

npm ci with --ignore-scripts where possible
pip install with --require-hashes
cosign verify on every container pull

Watch the maintainers

Subscribe to advisories. Pin major versions of critical packages. Auto-quarantine new releases for 48h before promoting to prod.

Build trusted

SLSA Level 3+ pipelines: hermetic builds, provenance attestations, two-person review for production releases.

Tools mentioned

SyftGrypecosignSigstoreDependabotSocket.dev

⟩ takeaway

Supply chain security is dependency hygiene plus build integrity. Both, not either.

⟩ keep reading

Mobile Malware in 2026: How It Gets In and How to Stay Safer

Spyware, banking trojans and sideloaded RATs — how modern mobile malware lands on a device, the tools that detect it, and the habits that keep you off the target list.

Phishing Defense That Actually Works

AiTM kits, QR 'quishing' and callback scams beat old training. What actually lowers real risk: phishing-resistant auth, a detonation layer on the inbox, and drills that mirror current tradecraft.

Splunk Detection Tips: From Noisy Alerts to Real-Time Signal

SPL patterns, accelerated data models and tstats tricks that turn a slow, noisy Splunk into a near-real-time detection engine — with snippets you can paste in today.