Further Reading¶

Resources for deeper exploration beyond this guide.

Books¶

Software Engineering¶

Software Engineering at Google — Winters, Manshreck, Wright (O'Reilly, 2020) Lessons from Google on building and maintaining software at scale. Chapters on dependency management, code review, and testing are particularly relevant.

Building Secure and Reliable Systems — Beyer et al. (O'Reilly, 2020) The Google SRE team on designing systems that are both secure and reliable. Excellent coverage of supply chain security principles.

The Phoenix Project — Kim, Behr, Spafford (IT Revolution, 2013) Novel format introduction to DevOps principles. Good for understanding why CI/CD and automation matter.

The DevOps Handbook — Kim et al. (IT Revolution, 2016) Practical companion to The Phoenix Project. Covers the technical practices in detail.

Security¶

Threat Modeling — Shostack (Wiley, 2014) How to think systematically about security threats. Relevant for understanding supply chain attack vectors.

Security Engineering — Anderson (Wiley, 3^rd ed. 2020) Comprehensive treatment of security principles. Dense but authoritative.

Standards and Frameworks¶

Supply Chain Security¶

SLSA (Supply-chain Levels for Software Artifacts) Framework for supply chain integrity with graduated assurance levels. https://slsa.dev/

NIST Secure Software Development Framework (SSDF) NIST SP 800-218. Government standard for secure development practices. https://csrc.nist.gov/projects/ssdf

OpenSSF Scorecard Automated security health metrics for open source projects. https://securityscorecards.dev/

in-toto Framework for securing software supply chain integrity. https://in-toto.io/

SBOMs¶

SPDX Specification Linux Foundation standard for software bills of materials. https://spdx.dev/specifications/

CycloneDX Specification OWASP standard for SBOMs with security focus. https://cyclonedx.org/specification/

NTIA SBOM Resources US government guidance on SBOM minimum elements. https://www.ntia.gov/page/software-bill-materials

Vulnerability Management¶

CVE Program The canonical vulnerability identification system. https://www.cve.org/

CVSS Specification How vulnerability severity scores are calculated. https://www.first.org/cvss/

Organizations¶

Open Source Security¶

Open Source Security Foundation (OpenSSF) Cross-industry collaboration on open source security. Hosts many relevant projects and working groups. https://openssf.org/

OWASP (Open Web Application Security Project) Application security resources, including dependency-check and CycloneDX. https://owasp.org/

Linux Foundation Hosts SPDX, OpenSSF, and many critical open source projects. https://www.linuxfoundation.org/

Government Resources¶

CISA (Cybersecurity and Infrastructure Security Agency) US federal agency with software supply chain security guidance. https://www.cisa.gov/

NIST Computer Security Resource Center Standards and guidelines for security. https://csrc.nist.gov/

Online Resources¶

Blogs and News¶

Ars Technica Security Good coverage of major security incidents with technical depth. https://arstechnica.com/security/

Bleeping Computer Security news, often first to report supply chain incidents. https://www.bleepingcomputer.com/

Snyk Blog Research and analysis on dependency security. https://snyk.io/blog/

Research¶

OpenSSF Research Academic and industry research on open source security. https://openssf.org/research/

ACM Digital Library Academic papers on software security (paywall, but many authors post preprints). https://dl.acm.org/

Conference Talks¶

Conference research is where supply chain attacks get taken apart in public, usually well before the technique shows up in a vendor blog post. DEF CON and Black Hat run the same week each August; USENIX Security and FIRST carry the academic and incident-response side.

DEF CON 34 — August 2026¶

Selected for relevance to this material, not for how good the talks were.

Registries nobody inventories¶

Install Me Maybe: Turning Claimable VS Code Extension IDs into Supply-Chain Attacks — Raphael "rcss" Silva (Main Stage) Claimable extension identifiers in the VS Code marketplace turned into package hijacking. Dependency confusion relocated to a registry almost nobody has inventoried, installing into the process that edits their source.

IDEViewer: Securing Developer Workstations from IDE Supply Chain Threats — securient (AppSec Village, Arsenal) The defensive counterpart. Editor extensions are dependencies with no lock file, no CI gate, and no review — installed by a developer, running with that developer's privileges.

The npm campaigns, mapped¶

Hunting the Contagious Trader Delivery Network — Alessandra Rizzo, Ariel Ropek (Recon Village, workshop) A North Korean operation against npm developers traced across 50+ malicious packages, 100+ GitHub repositories, and 30+ throwaway maintainer personas. Covers payloads hidden one to three hops deep in transitive dependencies, pivoting between accounts on email patterns and reused SSH keys, and payload staging on-chain via Solana. The field-work behind the pattern in Axios and keyv / ChainDrop.

Hunting GitHub to identify adversary TTPs in the wild — Paul McCarty, Jenn Gile (Adversary Village) Deriving attacker tradecraft from what they leave behind in public repositories, from the people who run OpenSourceMalware.

When the reviewer is a model¶

LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails — Aviv Donenfeld, Check Point (Main Stage) An ML-based pull request security gate in OpenSearch's CI, defeated by working the model's decision boundary rather than by injecting a prompt. Read it next to this guide's insistence that a signature is not a review — an LLM approval isn't one either, and it fails while producing the same green checkmark.

What Your Coding Agent Did Last Night: Runtime Security for AI Coding Agents — Inga Cherny (AppSec Village) Monitoring what an agent actually did, as distinct from what it was asked to do.

Agents, sandboxes, and MCP¶

The Sandbox is a Suggestion: Deconstructing AI Agent Sandboxes — Elad Meged, Novee Security (Main Stage) Containment failures in Claude Code, Gemini CLI, and Codex CLI — deterministic escapes arising from the design rather than from prompt injection. That distinction is the whole point: this is not a class of bug you fix by filtering inputs.

The New Software Supply Chain Nobody is Securing: MCP — Tamir Yehuda, Jessie Jamieson, Paul McCarty (Cloud Village, panel) MCP servers are dependencies. They install like dependencies and run with your credentials, and they arrived without the decade of registry hardening npm got dragged through. See Your Agent's Config Is Executable Content.

How Malicious AI Skills Hijack Your Agents — Jenn Gile (AppSec Village) Agent skills as a distribution channel — executable content shipped through a registry with no provenance story yet.

Vibe Check: How Adversaries Exploit Developer Trust from Malicious Repos to AI Agents — Michael Chan, KPMG Canada (Adversary Village) The attack surface created by fast, trusting, AI-assisted development. Pairs with Vibe Coding.

Models as artifacts¶

from_pretrained() to from_pwned(): Breaking HuggingFace's Trust — Yotam Perkal (AppSec Village) Pickled and Exposed: RCE in AI Serving Frameworks — Iggy (AppSec Village) Two halves of one problem: model weights are executable artifacts distributed through a registry, and the serving frameworks deserialize them. Background in AI/ML Supply Chain.

OWASP AIBOM Generator — Helen Oakley, Dmitry Raidman (AppSec Village, Arsenal) Bill of materials for AI systems — models, datasets, and the rest of what a conventional SBOM doesn't describe.

Pipelines and build environments¶

Trust the Cloud Pipeline, Lose the Kingdom — Shane Young (Cloud Village) A complete chain from low-privilege developer identity through pull request poisoning to credential exfiltration and persistence.

Minimal by Design: Building Hardened Near-Zero-CVE Container Images — Ritvik Arya, Kyle Quest (Cloud Village) Distroless images built with melange and apko, rebuilt daily, patching CVEs inside 48 hours rather than 30 days. The constructive answer to "pin your build environment" — pin it to something you rebuild deliberately.

WASM Was Not the Boundary: Sandcastles, Not Sandboxes — Saar Pearl, Vladimir Tokarev, Cyera (Main Stage) Pyodide sandbox escapes in workflow automation and CI, landing in a runtime with no native permission model.

Proactive Malicious Package Defense — Darren Meyer (AppSec Village, Arsenal) The defensive side of most of the above.

Schedules¶

Related Guides¶

Open Source Licensing Guide Companion guide covering software licensing fundamentals. Open Source Licensing Guide

Staying Current¶

Supply chain security evolves rapidly. To stay informed:

1. Follow OpenSSF — Major initiatives and research
2. Subscribe to security advisories — GitHub, npm, PyPI for your ecosystems
3. Monitor CISA alerts — Major vulnerabilities affecting critical infrastructure
4. Watch for post-mortems — When incidents happen, read the analyses
5. Read the conference schedules, not just the recordings — Talk titles and abstracts publish months before the video. Skimming a DEF CON or Black Hat schedule tells you what researchers found worth six months of their time, which is a reasonable early indicator of what you'll be reading advisories about next year

The tools and specific vulnerabilities will change. The principles in this guide should remain relevant.