Software Supply Chain Risks
Critical · Supply Chain · CWE-829
Description
Compromised build, typosquat packages, unsigned artifacts.
Root cause
Untrusted packages/build agents.
Impact
Widespread customer compromise.
Detection
SBOM, sigstore, provenance verification.
Mitigation
Signed builds; private registries; dependency review.
Secure coding
SLSA-style pipeline hardening.
Safe lab example
lab-sbom
Practise related skills in Labs or deepen on Academy library.