41554 blogs · 4,417,066 posts Claim your blog

Record · corpus.blog/posts/01a0bdd8-5e86-7068-9f06-ec5d1a5be64f

Open Infrastructure Is Not Free, Part II: The Hidden Cost of Running Package Registries

OpenSSF Blog · published 6 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at openssf.org Wayback capture

2blogs citing

First cited: 6 May 2026
Most recent: 13 May 2026
Rank this month: not ranked
Links from this post: 10
Words captured: 1,136

Cited by

Blog

In the post

Date

Listening, Learning, and Building Together at OSI Read at the source ↗

13 May 2026

rustfoundation.org

Rust Foundation and Package Registry Leaders Unite to Address Open Source Sustainability Crisis Read at the source ↗

6 May 2026

Links from this post

Link

Host

Open Infrastructure is Not Free: A Joint Statement on Sustainable Stewardship Read at the source ↗

https://www.sonatype.com/state-of-the-software-supply-chain/introduction

sonatype.com

https://www.sonatype.com/hubfs/1-2025_Website-Assets/SSCR_2025/SSCR_2026_final.pdf

sonatype.com

https://www.blackduck.com/content/dam/black-duck/en-us/reports/rep-ossra.pdf

blackduck.com

PyPI in 2025: A Year in Review Read at the source ↗

https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem

cisa.gov

https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23

github.com

Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance Read at the source ↗

https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager

cisa.gov

https://nvd.nist.gov/vuln/detail/cve-2021-44228

nvd.nist.gov