Software Supply Chain

A Wake-Up Call for Operators When OWASP first introduced “Using Known Vulnerable Components” back in 2013, it was a developer problem. Fast forward to 2025, and A03:2025 – Software Supply Chain Failures has become an operator’s nightmare. This category, now ranked #3 in the OWASP Top 10 (and #1 in the community survey), reflects how deeply our production environments rely on a sprawling, fragile, and opaque software supply chain. As an operator, I don’t just deploy code — I deploy trust. Every library, base image, CI/CD action, and IDE extension is part of that trust chain. When any one of them fails, it’s not just a bug — it’s a breach. ...

This blog post describes how OwnersBox quickly mitigated the threat of the “Shai-Hulud” npm supply chain attack in September 2025. The attack involved malicious packages that stole credentials and aggressively self-propagated.

Docket Number: CISA-2025-0007 Comment Deadline: October 3, 2025 Submission Portal: regulations.gov Executive Summary Interlynk appreciates the opportunity to provide feedback on CISA’s proposed “2025 Minimum Elements for a Software Bill of Materials (SBOM).” As developers of open-source SBOM quality and management tools, we bring a unique perspective grounded in practical implementation experience across diverse enterprise environments. Through our work on sbomqs (SBOM Quality Score) and sbomasm (SBOM Assembler), we have analyzed millions of SBOMs from various industries and toolchains, giving us deep insights into the real-world challenges of SBOM creation, validation, and consumption. Our tools help organizations assess SBOM completeness, manage multi-format SBOMs, and ensure compliance with evolving standards—experience that directly informs our response to these proposed minimum elements. ...

Hey SBOM enthusiasts 👋 An SBOM isn’t just a list of components anymore — it has detailed information of your software, which contains hundreds of components. And that’s what gives you the transparency of each and every component: such as, who authored it, who supplies it, under what license it’s released, and even what known vulnerabilities it carries. In other words, it’s not just an inventory — it’s visibility into the very DNA of your software. ...

GitHub Release Monitoring: SBOM Automation for External Repos 🚀 If you’ve been following our sbommv blog series, welcome to the fourth one—each post tackling a new challenge around SBOM automation. Here’s a quick recap of what we’ve covered so far: GitHub Release Transfers: How to fetch SBOMs from GitHub release pages and move them to systems like folders, Dependency-Track, Interlynk, or AWS S3. Folder Monitoring: Running sbommv in daemon mode to continuously watch a local folder and upload new SBOMs as they appear. AWS S3 Integration: Adding S3 as both an input and output adapter, enabling SBOM flows to and from S3 buckets. In short, sbommv is a tool built for automation—designed to seamlessly move SBOMs across systems, with support for format conversion, metadata enrichment, and monitoring workflows like folders. ...

Hey there 👋, SBOM enthusiasts ! Since the 2021 Cyber security Executive Order by Joe Biden. SBOMs (Software Bill of Materials) have become essential for software security and compliance. With countries like the EU, US, Germany, and India introducing their own SBOM regulations, it’s clear: SBOMs aren’t optional anymore—they’re the new standard. To meet this demand, tools for SBOM generation, signing, quality analysis, enrichment, and integration into security platforms have rapidly evolved, largely driven by the open-source community. ...

Introduction In today’s interconnected software ecosystem, applications are rarely built from scratch. Modern software is assembled from hundreds or even thousands of components - open source libraries, proprietary modules, and third-party services. This complexity creates a critical challenge: how do we know what’s actually inside our software? Enter the Software Bill of Materials (SBOM) - a comprehensive inventory that provides transparency into software components and their relationships. What is an SBOM? A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of all components, libraries, and modules that make up a software application. Think of it as a detailed ingredient list for software - just as food products list their ingredients and nutritional information, an SBOM lists all the software components and their dependencies. ...