←All topics

ci-cd

3 pieces of writing

security9 min read

From tj-actions to LiteLLM to MCP: supply chain compromise now operates at infrastructure scale

Eighteen months of supply chain attacks against AI infrastructure reveal a structural pattern: the build pipeline, the package registry and the runtime protocol all share the same trust model failure.

security9 min read

NPM worms, credential harvesting and 2 billion weekly downloads: supply-chain attacks have professionalised

When a GitHub Action rewrites its own history
security6 min read

When a GitHub Action rewrites its own history