A Crash Course in Software Supply Chain Security
Software supply chain security is an enormous problem: it covers everything from build systems to the code in open-source dependencies to package managers to social relationships between developers.
Unfortunately, we know about hundreds of supply chain compromises, and there are likely just as many that were never discovered or reported. All told, it's a pretty daunting task to sit down and try to understand the field. That's why Chainguard has put together a Software Supply Chain Reading List! This list covers some of the best explanations, analysis, proposals, and data sets in the space. A list like this can never be exhaustive, so we'd love your feedback—did we miss any of your favorites?
We hope you find it useful!
Share this article
Related articles
- security
We're putting our security to the test, and we want your help
Quincy Castro, CISO, and Alex Burrage, Director, Product Security
- security
Summer of Clearinghouses
Dan Lorenc, Co-founder and CEO
- security
@mastra npm scope takeover: 143 packages backdoored via compromised contributor account
Quincy Castro, CISO
- security
Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp
Quincy Castro, CISO
- security
Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads
Quincy Castro, CISO
- security
5 security myths that Mythos ended (as told by a CISO)
Quincy Castro, CISO