'supply-chain-security' 검색 결과

Implement software supply chain integrity verification for container builds using the in-toto framework to create cryptographically signed attestations across CI/CD pipeline steps.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Assess software dependencies, build pipelines, and container images for security risks. Create a software component inventory, check vulnerabilities and license conflicts, verify artifact signatures, and prioritize fixes based on whether vulnerable code can actually be reached.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating and auditing a software component inventory
• Prioritizing dependency vulnerabilities by actual exposure
• Auditing CI/CD pipelines and secret handling

Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing GitHub Actions workflow security
• Checking action version pinning
• Finding unsafe event expressions in scripts

Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Screening a new dependency before installation
• Reviewing dependency lists generated by AI
• Checking lockfile changes for swapped packages

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing projects that mix private and public package registries
• Checking exposure after internal package names have leaked
• Restricting package sources to approved private registries

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls, and trusted model promotion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore)

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

供应链安全时使用。适用于依赖漏洞扫描 / 镜像安全 / CI 投毒防护 / SBOM。融合 SLSA + Sigstore + Snyk + Trivy。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Triage npm packages for install-script malware, exfiltration, and worming behavior.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and prevent public-over-private name resolution in npm, PyPI, and Maven.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability Tespit across repositories at enterprise scale.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.