Posts from 2026

Layered defenses against software supply chain attacks

Software supply chain attacks target the dependencies, build systems, and publishing pipelines that produce the software we run, instead of the application itself. A single compromised package can reach millions of systems before anyone notices, and once it lands, it runs with the same trust and privileges as the rest of your code. The diagram below shows where these attacks typically land along the chain: Defending against this requires controls at every one of those stages. Recent supply chain compromises Two incidents from earlier this year show just how quickly a compromised pipeline can lead to large scale security incidents: LiteLLM (March 2026): A compromised CI/CD pipeline let attackers ship malicious releases of litellm, a widely used AI infrastructure library, that harvested cloud credentials and API keys on install…