Third-party Python packages are essential for many projects, but every dependency introduces potential supply-chain risk. Private repositories, vulnerability scanning, curated packages, and stricter review policies can all help,…
Third-party Python packages are incredibly useful, but every dependency introduces potential supply-chain risk. Private repositories, vulnerability scanning, dependency pinning, and stricter reviews can help, yet they may also…
We had a close call where an assistant suggested a dependency whose name differed from the legitimate package by one character. The package had almost no maintainer history,…
AI coding tools have suggested npm packages that looked questionable once I checked them manually. Some had very little publishing history, only one maintainer, minimal activity, or no…
We run workloads on Amazon EKS and currently pull container images directly from Amazon ECR Public, Docker Hub, and other external registries. We want to move everything into…
We sign every image built in our pipeline with Cosign, but I'm trying to separate what that signature proves from what we might be assuming it proves. It…
I'm currently using Chainguard images as the base for some workloads at my company, and I've recently started looking into their Chainguard Packages offering. I attended KubeCon EU…