Map the EU Cyber Resilience Act’s vulnerability disclosure, security update, and SBOM requirements onto CI/CD pipelines and dependency-management tools.
A technical breakdown of the malicious LiteLLM 1.107.0 PyPI release, examining how an infostealer and RAT harvested credentials from developer machines and CI pipelines, what secrets were exposed, and where package integrity verification broke down.
An analysis of how implicit CUDA assumptions in PyTorch CI/CD pipelines surface when targeting AWS Trainium through TorchNeuron, and which build, test, and deployment automation changes teams need to make.
GitLab patched two critical 9.9-severity regex engine RCE flaws enabling arbitrary code execution on self-managed instances, and this playbook walks CI/CD maintainers through root-cause analysis, patch verification, and pipeline risk reduction.
A practical walkthrough of using TypeScript and OpenAPI spec diffing in CI pipelines to catch contract-breaking API changes before they reach consumers.
Provenance attestations prove where an npm package was built, not who was at the keyboard when it was published, which is why a hijacked maintainer account can still push credential-stealing releases through a fully verified pipeline.
With Node 20 removed from GitHub Actions runners, this guide walks through updating action.yml from runs.using: node20 to node24 — rebuilding the bundled toolchain, refreshing dependencies, retesting inputs and outputs, and cutting a release that keeps existing workflows green.
An empirical teardown of Changesets v3's claim of an 88% smaller install, reproduced inside a real CI pipeline to see how ESM-only packaging and patch-level peer bumps affect monorepo release workflows.
GHAPPIER abused npm trusted publishing and GitHub Actions OIDC workflows to compromise 65 repositories and push a malicious loader through a poisoned package, exposing how CI/CD trust can be turned into an attack surface.
A practical walkthrough of lifecycle-script diffing and provenance verification for npm releases, showing how to detect and contain the kind of repository-to-registry backdoor chain that hit 65 GitHub repos.
Ephemeral CI runners hide vulnerable kernels behind short-lived hosts, so this post maps the actively exploited Linux kernel flaws and the Copy Fail root-escalation bug to CI and cloud workloads and lays out a practical kernel patch-triage checklist.
A technical walkthrough of the malicious Axios npm release shows exactly how a postinstall hook escalates from a dependency install into remote code execution inside CI pipelines, and which lockfile and install-script signals developers should audit first.
A practical analysis of the JFrog Artifactory authentication bypass being exploited for admin access, with a focus on how CI/CD compromise expands the real blast radius for developers and platform teams.
Learn how to integrate PentestCode into your CI/CD pipeline to automate penetration testing from code commit to security report and strengthen release-time security checks.
A developer-focused guide to embedding vulnerability detection, prioritization, and automated patching into CI/CD so teams can respond before CVEs become active threats.
GitHub’s updated actions/checkout release blocks common pwn request attack patterns, and JavaScript developers need to understand what changed to keep CI pipelines and pull request workflows secure.
A deep technical walkthrough on hardening game build pipelines against Argamal-style supply chain attacks by verifying artifacts, securing CI/CD, and preventing malicious payloads from reaching players.
A deep technical walkthrough of how to design guardrails, authorization boundaries, and deployment controls so tens of thousands of AI agents can operate at scale without accidentally shipping unreviewed changes to production.
Mini Shai-Hulud is an npm supply-chain attack that compromised @antv packages to steal CI/CD credentials from JavaScript development pipelines.
A GitHub Actions supply-chain attack redirected mutable version tags to attacker-controlled commits, enabling credential theft from CI/CD workflows that relied on unpinned actions.
Grafana’s GitHub token breach shows how a CI/CD secret leak can expose source code, enable extortion, and turn pipeline weakness into a supply chain security incident.
A Composer bug exposed GitHub tokens in CI logs, making immediate patching and token rotation essential for affected pipelines.
A technical walkthrough of the TanStack npm supply-chain compromise, focusing on how the backdoored packages attempted to harvest CI/CD, GitHub, and cloud credentials and what npm consumers should check immediately.
Learn how to integrate AI-powered code review into CI/CD pipelines to catch issues earlier, improve quality, and speed up development workflows.