SEVEN PLACES TO STOP A SUPPLY CHAIN ATTACK, FROM YOUR LOCKFILE TO YOUR CI PIPELINE

Summary from the TLDR InfoSec newsletter

Attackers spent the past year hitting npm packages and GitHub Actions. Most of those attacks were preventable with controls available at the time, and are available to you, too. Aikido's checklist [5] pairs each entry point with concrete defenses: * Dependency management, from package age policies to lockfiles and SBOMs * Access controls like phishing-resistant MFA and token scoping * CI/CD hardening, including workflow pinning and prompt injection defense * Permission scoping for MCP servers and AI agents * Container hardening and developer environment lockdown * Monitoring and incident response playbooks Work through the critical items first, before the next attack hits.