GitHub Actions is the weakest link

kept by eddie apr 28

GitHub Actions' default features—mutable tags, pull_request_target, template injection, and write-scoped tokens—have enabled a chain of supply-chain attacks on open-source registries, and GitHub's opt-in security roadmap won't fix the root causes.

Dockhand - Modern Docker Management
Dockhand is a free, self-hosted Docker management platform offering SSO, vulnerability scanning, Git deployments, and enterprise features under a BSL 1.1 license.
also on Trivy, #security, #open-source
Anthropic invests $1.5M in the Python Software Foundation
Anthropic donated $1.5 million over two years to the Python Software Foundation, earmarked primarily for improving Python ecosystem security and supply-chain protection.
also on PyPI, #security, #open-source
GitHub - cased/kit: The toolkit for AI devtools context engineering. Build with codebase mapping, symbol extraction, and many kinds of code search.
Kit provides a Python toolkit for codebase mapping, symbol extraction, and code search to build LLM-powered developer tools and agents.
also on PyPI, #open-source, #software-engineering
How to Evaluate an npm Package - 2026 Edition
A practical checklist for evaluating npm packages in 2026 covering security, maintenance, provenance, CI quality, and incident response to make informed dependency decisions.
also on #supply-chain-security, npm, #security, #open-source, #software-engineering
{{IW4QaZoc2}}
Perplexity open-sources Bumblebee, a read-only scanner that checks developer machines for risky packages, extensions, and AI tool configs during supply-chain incidents.
also on #supply-chain-security, #security, #open-source