[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Fscvs":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","scvs","SCVS","OWASP Software Component Verification Standard (SCVS)",27,"OWASP Foundation","**What it covers.** SCVS is an OWASP standard that defines requirements for identifying and reducing risk in the software supply chain. Requirements are grouped into areas such as inventory, software bill of materials, build environment, package management, component analysis and pedigree and provenance, with levels of increasing assurance.\n\n**In practice.** Organisations use SCVS to assess and improve how they track and verify the third party components they use and produce. Typical actions include maintaining component inventories, generating machine readable SBOMs, using controlled package repositories, analysing components for known vulnerabilities and licence issues and recording where components came from. Evidence includes SBOMs, repository configuration and analysis reports.\n\n**Common gaps.** Inventories often cover direct dependencies only. Provenance and pedigree, especially for modified open source components, are rarely recorded.",null,"https:\u002F\u002Fowasp.org\u002Fwww-project-software-component-verification-standard\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ai-generated-code-outpaces-security-teams-fueling-remediation-debt","AI-Generated Code Outpaces Security Teams, Fueling Remediation Debt","2026-08-24T14:21:16.131+00:00",{"slug":23,"title":24,"published_at":25},"trusted-appsec-scanners-weaponized-as-supply-chain-attack-vectors","Trusted AppSec Scanners Weaponized as Supply Chain Attack Vectors","2026-07-29T18:21:01.503+00:00",{"slug":27,"title":28,"published_at":29},"aivex-framework-targets-gaps-in-software-supply-chain-vulnerability-prioritization","AIVEX Framework Targets Gaps in Software Supply Chain Vulnerability Prioritization","2026-06-24T16:21:43.88+00:00",{"slug":31,"title":32,"published_at":33},"ais-rapid-release-cycles-create-silent-security-windows","AI's Rapid Release Cycles Create Silent Security Windows","2026-06-16T22:20:55.745+00:00",{"slug":35,"title":36,"published_at":37},"npm-12-addresses-automatic-script-execution-vulnerability-in-package-dependencies","NPM 12 Addresses Automatic Script Execution Vulnerability in Package Dependencies","2026-06-13T16:20:14.151+00:00",{"slug":39,"title":40,"published_at":41},"ai-powered-cicd-tools-expose-secrets-through-prompt-injection","AI-Powered CI\u002FCD Tools Expose Secrets Through Prompt Injection","2026-06-05T18:21:17.115+00:00",{"slug":43,"title":44,"published_at":45},"malicious-npm-package-steals-openai-authentication-tokens","Malicious npm Package Steals OpenAI Authentication Tokens","2026-06-01T12:07:43.013+00:00",{"slug":47,"title":48,"published_at":49},"typosquatted-npm-packages-target-developer-credentials","Typosquatted npm Packages Target Developer Credentials","2026-05-29T06:20:13.845+00:00",{"slug":51,"title":52,"published_at":53},"massive-npm-package-poisoning-attack-compromises-developer-credentials","Massive npm Package Poisoning Attack Compromises Developer Credentials","2026-05-22T05:42:41.363357+00:00",{"slug":55,"title":56,"published_at":57},"malicious-dependencies-compromise-popular-axios-npm-package","Malicious Dependencies Compromise Popular Axios npm Package","2026-04-21T01:09:08.647+00:00",{"slug":59,"title":60,"published_at":61},"critical-rce-vulnerability-in-popular-javascript-library-affects-52m-downloads","Critical RCE Vulnerability in Popular JavaScript Library Affects 52M Downloads","2026-04-20T12:09:37.658+00:00",{"slug":63,"title":64,"published_at":65},"wordpress-plugin-supply-chain-compromise-affects-thousands","WordPress Plugin Supply Chain Compromise Affects Thousands","2026-04-15T22:08:42.118+00:00",[67,72,77,82,86,91],{"slug":68,"name":69,"problem":70,"stories":71},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",24,{"slug":73,"name":74,"problem":75,"stories":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",14,{"slug":78,"name":79,"problem":80,"stories":81},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",10,{"slug":83,"name":84,"problem":85,"stories":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":87,"name":88,"problem":89,"stories":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,{"slug":92,"name":93,"problem":94,"stories":95},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",4,[97,103,108,113,118,123,128,133],{"family":98,"item":99,"code":100,"title":101,"together":102},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",25,{"family":104,"item":105,"code":106,"title":107,"together":71},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":98,"item":109,"code":110,"title":111,"together":112},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",13,{"family":104,"item":114,"code":115,"title":116,"together":117},"7","Control 7","Continuous Vulnerability Management",9,{"family":104,"item":119,"code":120,"title":121,"together":122},"16","Control 16","Application Software Security",7,{"family":124,"item":125,"code":126,"title":127,"together":122},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",{"family":129,"item":130,"code":131,"title":132,"together":90},"nist-800-53","sc-7","SC-7","Boundary Protection",{"family":129,"item":134,"code":135,"title":136,"together":95},"sa-12","SA-12","Supply Chain Protection"]