[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:slsa\u002Foverview":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",294,"Open Source Security Foundation (OpenSSF)","**What it covers.** SLSA is an open framework, hosted by the Open Source Security Foundation, for improving the integrity of software artefacts. Version 1.0 defines a build track with increasing levels that focus on producing provenance, a verifiable record of how and from what an artefact was built, and on hardening the build platform against tampering.\n\n**In practice.** Organisations generate signed provenance for their builds, use hosted or hardened build systems that isolate builds from each other and from developers, and verify provenance before deploying or consuming artefacts. Evidence includes provenance attestations, build platform configuration, verification policies at deployment and a record of which level each product meets.\n\n**Common gaps.** Provenance is often generated but never verified by consumers, which removes most of its value. Build systems may also allow manual steps or shared credentials that undermine the claimed level.",null,"https:\u002F\u002Fslsa.dev\u002F","Read about SLSA","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":23,"title":24,"published_at":25},"malicious-aur-packages-execute-root-level-malware-via-typosquatting","Malicious AUR Packages Execute Root-Level Malware via Typosquatting","2026-10-15T18:20:20.988+00:00",{"slug":27,"title":28,"published_at":29},"pythons-new-startup-files-reduce-but-dont-eliminate-supply-chain-risk","Python's New Startup Files Reduce But Don't Eliminate Supply Chain Risk","2026-10-15T16:21:36.544+00:00",{"slug":31,"title":32,"published_at":33},"ai-coding-agents-need-zero-trust-security-boundaries-to-prevent-production-disasters","AI Coding Agents Need Zero-Trust Security Boundaries to Prevent Production Disasters","2026-10-13T22:21:43.666+00:00",{"slug":35,"title":36,"published_at":37},"docker-hub-flaw-allowed-cross-user-image-manipulation-for-over-two-years","Docker Hub Flaw Allowed Cross-User Image Manipulation for Over Two Years","2026-10-13T20:21:33.66+00:00",{"slug":39,"title":40,"published_at":41},"npm-trusted-publishing-flaw-exposed-1500-packages-to-hijacking","npm Trusted Publishing Flaw Exposed 1,500+ Packages to Hijacking","2026-10-13T18:21:16.112+00:00",{"slug":43,"title":44,"published_at":45},"docker-hub-flaw-enabled-image-tampering-and-user-impersonation","Docker Hub Flaw Enabled Image Tampering and User Impersonation","2026-10-13T16:20:46.354+00:00",{"slug":47,"title":48,"published_at":49},"ai-agents-exploited-via-malicious-package-supply-chain-attacks","AI Agents Exploited via Malicious Package Supply Chain Attacks","2026-10-12T13:20:21.797+00:00",{"slug":51,"title":52,"published_at":53},"malicious-github-actions-workflows-steal-secrets-from-thousands-of-repos","Malicious GitHub Actions Workflows Steal Secrets from Thousands of Repos","2026-10-09T22:21:02.359+00:00",{"slug":55,"title":56,"published_at":57},"ghostaction-campaign-hijacks-github-maintainer-accounts-to-steal-cloud-credentials-at-scale","GhostAction Campaign Hijacks GitHub Maintainer Accounts to Steal Cloud Credentials at Scale","2026-10-09T14:21:15.572+00:00",{"slug":59,"title":60,"published_at":61},"fakegit-campaign-uses-17000-malicious-github-repos-to-spread-malware","FakeGit Campaign Uses 17,000+ Malicious GitHub Repos to Spread Malware","2026-10-08T18:20:38.285+00:00",{"slug":63,"title":64,"published_at":65},"compromised-npm-package-delivers-self-propagating-credential-stealing-worm","Compromised npm Package Delivers Self-Propagating Credential-Stealing Worm","2026-10-08T08:21:10.572+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",261,{"slug":73,"name":74,"problem":75,"stories":76},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",135,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",124,{"slug":83,"name":84,"problem":85,"stories":86},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",61,{"slug":88,"name":89,"problem":90,"stories":91},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",51,{"slug":93,"name":94,"problem":95,"stories":96},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",31,[98,104,110,115,120,126,132,138],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",272,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","2","Control 2","Inventory and Control of Software Assets",241,{"family":105,"item":111,"code":112,"title":113,"together":114},"16","Control 16","Application Software Security",208,{"family":99,"item":116,"code":117,"title":118,"together":119},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",176,{"family":121,"item":122,"code":123,"title":124,"together":125},"gdpr","32","Article 32","Security of processing",116,{"family":127,"item":128,"code":129,"title":130,"together":131},"nist-800-53","sa-12","SA-12","Supply Chain Protection",111,{"family":133,"item":134,"code":135,"title":136,"together":137},"nist-csf","id-sc","ID.SC-4","Supply Chain Risk Management (CSF 1.1)",82,{"family":139,"item":140,"code":141,"title":142,"together":143},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",72]