Topic
supply-chain
Risks that arrive through dependencies, build images, package registries and trust stores rather than through code written in-house.
3 engineering notes.
- eMudhra CA compromise: eight intermediate keys anyone could recoverEight eMudhra intermediate CA keys were generated with almost no randomness. What happened, which root was distrusted, and which clients stayed exposed after browsers were fixed.
- Argo CD October 2026: eight advisories, then a compromised root CA in the imagesArgo CD 3.3.15, 3.4.10 and 3.5.4 fix four critical repo-server and AppProject flaws. Only 3.3.18, 3.4.12 and 3.5.6 also drop the compromised eMudhra root from the image.
- Install scripts are the supply-chain attack surfaceThe 2026 npm and PyPI compromises ran through lifecycle scripts and stolen publish tokens. A probe that shows what your install actually executes.
Related service: Security & Penetration Testing →
