supply-chain-security
Installation
SKILL.md
Supply Chain Security
Most teams can name every line of code they wrote and none of the hundreds of transitive dependencies that ended up in the build. The supply chain attack doesn't target your code — it targets the thing your code trusts implicitly: a package registry, a build server, a base image, a CI action pulled by a floating tag. Trust that isn't verified is just an assumption wearing a disguise.
The goal is to be able to answer, for any artifact running in production: what's in it, how it was built, and whether it's been altered since. If you can't answer all three, you're trusting a black box.
If you can't prove what's in an artifact and how it got there, you're one compromised dependency away from finding out the hard way.