Record · corpus.blog/posts/01a087c3-11b5-7229-a9c7-32da471ab9e3

Composer and Packagist under supply chain stress

phpunit.expert · published 15 July 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at phpunit.expert Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 72
Words captured: 6,317

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://www.splunk.com/en_us/blog/security/npm-supply-chain-attack-detection-analysis.html

splunk.com

https://www.paloaltonetworks.com/blog/cloud-security/npm-supply-chain-attack/

paloaltonetworks.com

https://www.sonatype.com/state-of-the-software-supply-chain/2026/open-source-malware

sonatype.com

https://www.globenewswire.com/news-release/2026/01/28/3227372/0/en/Sonatype-Research-Reveals-OSS-Malware-Grows-75-as-Yearly-Open-Source-Downloads-Surpass-9-8-Trillion.html

globenewswire.com

https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise

socket.dev

https://www.aikido.dev/blog/supply-chain-attack-targets-laravel-lang-packages-with-credential-stealer

aikido.dev

https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/

blog.packagist.com

https://blog.packagist.com/composer-2-10-release/

blog.packagist.com

https://blog.packagist.com/blocking-malware-downloads-for-every-composer-version-in-private-packagist/

blog.packagist.com

https://blog.packagist.com/enforce-a-safe-composer-version-across-your-organization/

blog.packagist.com

https://blog.packagist.com/restricting-composer-plugins-across-your-organization/

blog.packagist.com

https://blog.packagist.com/immutable-versions-on-packagist/

blog.packagist.com

https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

medium.com

https://blog.packagist.com/preventing-dependency-hijacking/

blog.packagist.com

https://getcomposer.org/doc/06-config.md

getcomposer.org

https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html

cheatsheetseries.owasp.org

https://blog.packagist.com/composer-2-9/

blog.packagist.com

The Bouncer in the Dependency Resolver Read at the source ↗

phpunit.expert

https://docs.npmjs.com/cli/commands/npm-audit

docs.npmjs.com

https://pypi.org/project/pip-audit/

pypi.org

https://nesbitt.io/2026/05/29/composer-dependency-policies.html

nesbitt.io

https://www.aikido.dev/

aikido.dev

https://github.com/package-url/purl-spec

github.com

https://repo.packagist.org/lists/all/summary.json

repo.packagist.org

https://github.com/composer/composer/issues/12786

github.com

https://github.com/composer/composer/pull/12766

github.com

https://github.com/composer/composer/pull/12804

github.com

https://github.com/composer/packagist/pull/1681

github.com

https://packagist.org/about/version-immutability

packagist.org

https://packagist.org/transparency-log

packagist.org

https://blog.packagist.com/strengthening-php-supply-chain-security-with-a-transparency-log-for-packagist-org/

blog.packagist.com

https://blog.pypi.org/posts/2024-12-30-quarantine/

blog.pypi.org

https://docs.npmjs.com/reporting-malware-in-an-npm-package/

docs.npmjs.com

https://hexdocs.pm/hex/Mix.Tasks.Hex.Retire.html

hexdocs.pm

https://github.com/AikidoSec/safe-chain

github.com

https://socket.dev/blog/introducing-safe-npm

socket.dev

https://docs.socket.dev/docs/socket-firewall-free

docs.socket.dev

https://www.cnbc.com/2020/03/16/microsoft-github-agrees-to-buy-code-distribution-start-up-npm.html

cnbc.com

The PSF has withdrawn a $1.5 million proposal to US government grant program Read at the source ↗

pyfound.blogspot.com

Anthropic invests $1.5 million in the Python Software Foundation and open source security Read at the source ↗

pyfound.blogspot.com

https://rubycentral.org/news/rubygems-fracture-incident-report/

rubycentral.org

https://rubycentral.org/news/strengthening-the-stewardship-of-rubygems-and-bundler/

rubycentral.org

Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover Read at the source ↗

joel.drapper.me

https://pup-e.com/goodbye-rubygems.pdf

pup-e.com

https://rubycentral.org/news/a-new-chapter-for-ruby-central/

rubycentral.org

https://gem.coop/

gem.coop

https://rustfoundation.org/members/

rustfoundation.org

https://github.com/rust-lang/crates.io

github.com

https://www.sonatype.com/press-releases/vista-acquires-majority-interest-in-sonatype

sonatype.com

https://packagist.com/about/imprint

packagist.com

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847

eur-lex.europa.eu

https://www.sovereign.tech/

sovereign.tech

https://netzpolitik.org/2024/open-source-bundestag-staerkt-sovereign-tech-fund/

netzpolitik.org

https://eu-stf.openforumeurope.org/

eu-stf.openforumeurope.org

https://digital-strategy.ec.europa.eu/en/policies/open-source-strategy

digital-strategy.ec.europa.eu

Introducing 'Trusted Publishers' Read at the source ↗

blog.pypi.org

PyPI's Sigstore-powered attestations are now generally available Read at the source ↗

blog.sigstore.dev

Securing PyPI accounts via Two-Factor Authentication Read at the source ↗

blog.pypi.org

https://central.sonatype.org/register/namespace/

central.sonatype.org

https://central.sonatype.org/publish/requirements/gpg/

central.sonatype.org

https://mozilla.github.io/cargo-vet/

mozilla.github.io

https://github.com/google/rust-crate-audits

github.com

https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/

github.blog

https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

github.blog

https://docs.npmjs.com/cli/v11/using-npm/config

docs.npmjs.com

https://github.blog/changelog/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm/

github.blog

https://github.com/composer/composer/issues/12847

github.com

https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html

nesbitt.io

https://blog.rubygems.org/2025/08/25/rubygems-security-response.html

blog.rubygems.org

https://repos.openssf.org/principles-for-package-repository-security

repos.openssf.org

https://nesbitt.io/2026/03/19/the-fragmented-world-of-dependency-policy.html

nesbitt.io

https://phpc.tv/w/aqFFdZBJhAb6S7sYoTaofN

phpc.tv