SLSA

Assess

Techniques

Supply-chain security framework for software build provenance and integrity.

Why it's here

Placed in Assess: 2 article(s) of evidence from 2 source(s), led by security coverage, with 0 in the last 30 days. Confidence 38%.

6InfoQ·9/8/2026framework_update
Packer 1.16 adds native SLSA provenance for machine images
HashiCorp released Packer v1.16.0 with native support for generating, signing, and verifying SLSA provenance attestations for each built machine image. The update gives teams a tamper-evident record of image creation without requiring additional supply-chain tooling.
10The New Stack·8/31/2026security
Shai-Hulud Worm Turns npm Publishing Into a Supply-Chain Attack
The article describes a series of self-propagating npm supply-chain attacks, starting with Shai-Hulud and later variants that stole credentials, republished poisoned packages, and spread without human action. The latest variant, ChainDrop, abused a legitimate signed release pipeline and valid SLSA attestations to bypass trust checks, while also using an Ethereum smart contract for command infrastructure.