Research, experiments, and implementation notes filed under supply-chain.
The eMudhra CA Compromise Is a Runtime Patch Problem
Eight eMudhra intermediate CA keys were recoverable from public certificates. Browsers moved quickly, but runtimes, containers, proxies, and embedded clients need explicit trust-store updates and tests.
GitHub's Package Firewall Adds an Install-Time Gate for npm
GitHub's package firewall can hold back new npm releases, block known malware and vulnerabilities, and flag supply-chain regressions before agents or CI install them.
GitHub Rule Insights Make Repository Governance Easier To See
GitHub's rule insights dashboard is now generally available at repository and organization levels, giving teams a faster way to audit ruleset failures, bypasses, and enforcement trends.
GitHub's License Data Update Makes SBOM Reviews Less Noisy
GitHub is prioritizing registry license metadata in the dependency graph, which should make SBOMs and dependency review checks easier to trust.