Guides
Guides to software supply chain security
Each guide answers one question. Start with what a supply chain attack is. Then read how to stop one and how to check an update before it runs.
Supply chain attacks
- What is a supply chain attack?The definition, how a software attack works, and real examples from SolarWinds to axios.
- How to prevent supply chain attacksNine controls that cover your build steps, your publishing steps and the computers where your team vibe codes.
- Detect an attack without a CVEA hijacked package has no CVE on the day it ships. Catch the update by what it newly can do.
- npm supply chain attacksHow malware gets into npm packages, the attacks from 2018 to 2026, and how to protect your team.
- Software supply chain security toolsThree kinds of tool and six vendors, compared by category, function and free tier.
Updates and cost
- Dependabot vs RenovateThe two update bots compared, and what neither one checks in the update it opens.
- The cost of a compromised updateSolarWinds reported $50 million in insurance payments for its 2020 attack. See the source.
See the attacks behind the guides.
The attack library holds 122 real attacks from 2009 to 2026. Each one has the dates, the versions and how to check.