Record · corpus.blog/posts/01a0875f-b7bb-7379-ba9c-ab82adbc03d3

Dependency cooldowns: a simple supply chain fix

christian-schneider.net · published 27 January 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at christian-schneider.net Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 33
Words captured: 6,139

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://nx.dev/blog/s1ngularity-postmortem

nx.dev

https://github.com/axios/axios/issues/10604

github.com

https://docs.litellm.ai/blog/security-update-march-2026

docs.litellm.ai

Update: Ongoing Investigation and Continued Remediation Read at the source ↗

aquasec.com

https://research.jfrog.com/post/xinference-compromise/

research.jfrog.com

https://checkmarx.com/blog/checkmarx-security-update-april-22/

checkmarx.com

https://checkmarx.com/blog/checkmarx-security-update/

checkmarx.com

Postmortem: TanStack npm supply-chain compromise Read at the source ↗

tanstack.com

Ship fast, but guard faster: securing DevOps itself Read at the source ↗

christian-schneider.net

https://grafana.com/blog/grafana-labs-security-update-latest-on-tanstack-npm-supply-chain-ransomware-incident/

grafana.com

The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) Read at the source ↗

unit42.paloaltonetworks.com

https://github.com/microsoft/durabletask-python/issues/137

github.com

https://access.redhat.com/security/vulnerabilities/RHSB-2026-006

access.redhat.com

https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents

stepsecurity.io

https://www.stepsecurity.io/blog/supply-chain-compromise-codfish-semantic-release-action

stepsecurity.io

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

docs.github.com

https://docs.renovatebot.com/key-concepts/minimum-release-age/

docs.renovatebot.com

https://pnpm.io/settings

pnpm.io

https://github.com/npm/cli/releases/tag/v11.10.0

github.com

https://github.com/Homebrew/brew/pull/21888

github.com

https://github.com/Homebrew/brew/pull/21919

github.com

https://github.com/Homebrew/brew/pull/21920

github.com

https://github.com/Homebrew/brew/pull/22253

github.com

https://github.com/Homebrew/brew/pull/22555

github.com

https://docs.brew.sh/Supply-Chain-Security

docs.brew.sh

Postmortem: Nx Console v18.95.0 supply-chain compromise Read at the source ↗

nx.dev

https://x.com/github/status/2056949168208552080

x.com

https://code.visualstudio.com/updates/v1_123

code.visualstudio.com

https://github.com/microsoft/vscode/issues/319212

github.com

https://github.com/microsoft/vscode/issues/317830

github.com

https://christian-schneider.net/consulting/devsecops-pipeline/

christian-schneider.net

https://christian-schneider.net/slides/Coding-Agent-Security-Cheat-Sheet.pdf

christian-schneider.net

https://christian-schneider.net/consulting/coding-agent-security/

christian-schneider.net