Supply-chain field notes.
Writeups on real supply-chain attacks, how detection holds up, and keeping builds safe — from the team building Upwarden.
Two lines to close your CI's supply-chain door
setup-upwarden is now on the GitHub Marketplace — the google-github-actions/auth for software supply-chain security. Keyless OIDC, every dependency fetch authenticated, attributed, and policy-enforced.
David Ashwood Read → One monorepo, many supply chains — discovered, not declared
A monorepo is N independent projects sharing a repo. Upwarden finds each one's dependency footprint from what it actually pulled through the firewall — no package.json parsing, no manual setup.
David Ashwood Read → Why silent rollback matters more than blocking
A security control that breaks CI has a short life expectancy. Resolving around a blocked version instead of erroring is what makes a dependency firewall something teams keep switched on.
David Ashwood Read → Anatomy of a compromised maintainer
Most supply-chain attacks don't start with a zero-day. They start with a phished maintainer and a package you already trust — and the whole chain runs before a human reads a single diff.
David Ashwood Read → Subscribe via RSS.