---
title: "#supply-chain-security articles | Hashnode"
description: "Explore 39 articles tagged #supply-chain-security on Hashnode. Tutorials, guides, and how-tos from the community."
url: "https://hashnode.com/tag/supply-chain-security"
---

Tag

# #supply-chain-security

39 posts · 0 followers

[Damiano Bianda](https://hashnode.com/@damianobianda) · [16h ago](https://hashnode.com/posts/seven-neurons-and-a-trigger-string-what-microsoft-s-lazarus-backdoor-actually-proves/6af43c78d48bcb5188563a40)

### [Seven Neurons and a Trigger String: What Microsoft's Lazarus Backdoor Actually Proves](https://damianobianda.hashnode.dev/seven-neurons-and-a-trigger-string-what-microsoft-s-lazarus-backdoor-actually-proves?utm_source=hashnode&utm_medium=feed)

The headline writes itself: Microsoft researchers backdoored an AI model by editing fewer than 10 neurons, no retraining required. It sounds like the opening of a disaster movie. The research, publish

6 min read · [damianobianda.hashnode.dev](https://damianobianda.hashnode.dev/seven-neurons-and-a-trigger-string-what-microsoft-s-lazarus-backdoor-actually-proves?utm_source=hashnode&utm_medium=feed)

[Muhammad Ali Mughal](https://hashnode.com/@ali978123) · [5d ago](https://hashnode.com/posts/subresource-integrity-sri-pin-your-cdn-scripts/6aee206a086af0be7468005a)

### [Subresource Integrity (SRI): Pin Your CDN Scripts](https://resume-ai.hashnode.dev/subresource-integrity-sri-pin-your-cdn-scripts?utm_source=hashnode&utm_medium=feed)

Every <script src="https://cdn..."> on your site is a standing grant of full JavaScript execution to whoever controls that file tomorrow. Not the file you reviewed, the file the CDN serves on the next

9 min read · [resume-ai.hashnode.dev](https://resume-ai.hashnode.dev/subresource-integrity-sri-pin-your-cdn-scripts?utm_source=hashnode&utm_medium=feed)

[Amaresh Pelleti](https://hashnode.com/@amareswer) · [Nov 4](https://hashnode.com/posts/github-actions-lockfile-guide-how-actions-lock-works/6aeb74d29e66e64bd2df5004)

### [GitHub Actions Lockfile Guide: How actions.lock Works](https://devtoolhub.hashnode.dev/github-actions-lockfile-guide-how-actions-lock-works?utm_source=hashnode&utm_medium=feed)

Originally published on DevToolHub. GitHub Actions workflow lockfiles went into public preview on October 14, 2026 and became generally available on October 28. The timing is almost funny: GitHub aut

13 min read · [devtoolhub.hashnode.dev](https://devtoolhub.hashnode.dev/github-actions-lockfile-guide-how-actions-lock-works?utm_source=hashnode&utm_medium=feed)

[Muhammad Ali Mughal](https://hashnode.com/@ali978123) · [Oct 31](https://hashnode.com/posts/how-to-verify-a-download-sha-256-gpg-and-sigstore/6ae5fcfc79908dcd8cbf2f5a)

### [How to Verify a Download: SHA-256, GPG and Sigstore](https://resume-ai.hashnode.dev/how-to-verify-a-download-sha-256-gpg-and-sigstore?utm_source=hashnode&utm_medium=feed)

A matching SHA-256 checksum proves one thing: the file you have is the file the checksum describes. It does not prove the file is safe, or that it came from the project you think it did. If an attacke

9 min read · [resume-ai.hashnode.dev](https://resume-ai.hashnode.dev/how-to-verify-a-download-sha-256-gpg-and-sigstore?utm_source=hashnode&utm_medium=feed)

[404 Founders](https://hashnode.com/@404-founders) · [Oct 24](https://hashnode.com/posts/alert-litellm-supply-chain-credential-stealer/6adc3309b341d3dfb91e3e82)

### [LiteLLM Supply Chain Attack: Credential Stealer in PyPI and Docker](https://404-founders.com/blog/alert-litellm-supply-chain-credential-stealer?utm_source=hashnode&utm_medium=feed)

LiteLLM 1.107.0 compromised via stolen GitHub tokens. Credential stealer targeted AWS, Azure, GCP, AI service tokens. Pin to 1.106.2 and rotate all keys.

7 min read · [404-founders.com](https://404-founders.com/blog/alert-litellm-supply-chain-credential-stealer?utm_source=hashnode&utm_medium=feed)

[Vikram Kumar Shukla](https://hashnode.com/@vikramkumarshukla) · [Oct 23](https://hashnode.com/posts/the-litellm-release-everyone-upgraded-to-was-poisoned/6adae3d7a8cc02e9309c0896)

### [The LiteLLM release everyone upgraded to was poisoned](https://vikramkumarshukla.hashnode.dev/the-litellm-release-everyone-upgraded-to-was-poisoned?utm_source=hashnode&utm_medium=feed)

The LiteLLM release everyone upgraded to was poisoned I pinned my dependencies this week. Not because of a CVE. Because three startup files shipped inside a release tens of thousands of projects depen

4 min read · [vikramkumarshukla.hashnode.dev](https://vikramkumarshukla.hashnode.dev/the-litellm-release-everyone-upgraded-to-was-poisoned?utm_source=hashnode&utm_medium=feed)

[AngusKit](https://hashnode.com/@anguskit) · [Oct 12](https://hashnode.com/posts/how-to-roll-out-a-supply-chain-gate-sbom-then-vex-then-refuse-download/6accdf6b67dfec97ed28fefd)

### [How to roll out a supply-chain gate: SBOM, then VEX, then refuse download](https://anguskit.hashnode.dev/how-to-roll-out-a-supply-chain-gate-sbom-then-vex-then-refuse-download?utm_source=hashnode&utm_medium=feed)

Thousands of findings nobody reads, or day-one blocking that paralyzes the company—roll out SBOM → VEX → “refuse download on fail” on AngusRepo.

7 min read · [anguskit.hashnode.dev](https://anguskit.hashnode.dev/how-to-roll-out-a-supply-chain-gate-sbom-then-vex-then-refuse-download?utm_source=hashnode&utm_medium=feed)

[404 Founders](https://hashnode.com/@404-founders) · [Sep 18](https://hashnode.com/posts/gemstuffer-openai-rubygems-supply-chain-attack/6aad52767e24232ac77afbb8)

### [GemStuffer: When AI Agents Hit a Live Registry](https://404-founders.com/blog/gemstuffer-openai-rubygems-supply-chain-attack?utm_source=hashnode&utm_medium=feed)

3,022 malicious gems, one RCE in a docs builder, and an attribution question RubyGems still won't answer.

6 min read · [404-founders.com](https://404-founders.com/blog/gemstuffer-openai-rubygems-supply-chain-attack?utm_source=hashnode&utm_medium=feed)

[infosprint technologies](https://hashnode.com/@infosprint) · [Sep 1](https://hashnode.com/posts/software-supply-chain-security-what-changes-when-trusted-code-enters-production/6a96a1debd281d47c3f2b378)

### [Software Supply Chain Security: What Changes When Trusted Code Enters Production](https://infosprinttechnologies.hashnode.dev/software-supply-chain-security-what-changes-when-trusted-code-enters-production?utm_source=hashnode&utm_medium=feed)

Explore software supply chain security and why trusted code needs security controls before it reaches production.

7 min read · [infosprinttechnologies.hashnode.dev](https://infosprinttechnologies.hashnode.dev/software-supply-chain-security-what-changes-when-trusted-code-enters-production?utm_source=hashnode&utm_medium=feed)

[Manu Shukla](https://hashnode.com/@mr-manushukla) · [Aug 23](https://hashnode.com/posts/cloudflare-gateway-now-blocks-npm-and-pypi-downloads-but-an-unparseable-version-matches-nothing-incl/6a8aec1a7b03e1e3f9a611bc)

### [Cloudflare Gateway now blocks npm and PyPI downloads, but an unparseable version matches nothing, including !=](https://ecorpit.hashnode.dev/cloudflare-gateway-now-blocks-npm-and-pypi-downloads-but-an-unparseable-version-matches-nothing-incl?utm_source=hashnode&utm_medium=feed)

Cloudflare Gateway now blocks npm and PyPI downloads, but an unparseable version matches nothing, including != Summary. Cloudflare shipped package registry security to Gateway on 13 August 2026, letti

14 min read · [ecorpit.hashnode.dev](https://ecorpit.hashnode.dev/cloudflare-gateway-now-blocks-npm-and-pypi-downloads-but-an-unparseable-version-matches-nothing-incl?utm_source=hashnode&utm_medium=feed)