AI Briefing#supply-chain-security
The latest AI and developer news about #supply-chain-security, with the original source and a short summary.
The latest AI and developer news about #supply-chain-security, with the original source and a short summary.
The protection applies automatically to new builds on all plans with no configuration required, failing deployments if a blocked dependency is detected.
The Department of Homeland Security has issued an order excluding DeepSeek products from federal civilian agency procurements and requiring their removal from existing IT systems.
A GitHub Blog author outlines 10 technical talks for GitHub Universe 2026, covering agent memory, supply chain security, offline development, and context management, scheduled for October 28–29.
Google analyzed structural shifts in the AI-driven threat landscape and unveiled a strategy for building an integrated defense system at machine speed.
GitHub has expanded its malware advisories to eight ecosystems by leveraging OpenSSF data.
GitHub has introduced new security measures to defend against supply chain attacks targeting npm and GitHub Actions.
GitHub Dependabot has introduced a cooldown feature by default that delays PR creation for at least 3 days after a new release, in response to supply chain attacks.
A new supply chain security threat has been discovered that exploits configuration files in AI coding tools such as VS Code, Cursor, and Claude Code.
220,000 valid credentials were found in Hugging Face's public training data.
The Java testing library jqwik has shipped Protestware that outputs a message designed to trick coding agents into disregarding their instructions.
A ransomware breach at Foxconn reportedly exposed Apple and Nvidia design documents along with AI data center topology.
OpenAI has announced an update for its Mac app, citing the replacement of its **signing certificate**.
Hundreds of malicious models and skills have been identified in the Hugging Face and ClawHub repositories.
Danggeun blocked a Supply Chain Attack by applying a cooldown to its internal PyPI Proxy.
Danggeun introduced a proxy cooldown to block Python package supply chain attacks.
A centralized upload queue is safer and more consistent than distributed dependency cooldowns.
At scale, researchers demonstrated that LLM API routers can intercept requests to carry out injection and exfiltration attacks.
Due to the impact of the Axios supply chain attack, OpenAI is replacing its macOS signing certificates.
It points out the security risk that `npx -y ...@latest` automatically runs new npm code on every session, and suggests switching to a pinned-version local execution instead.
GitHub is strengthening open source supply chain security, focusing on GitHub Actions and npm.