Pillar guide

Software Supply Chain Security

One defense path connecting package cooldowns, SIP, Shai-Hulud, IX Hexbreaker, SBOM, VEX, SLSA, Cosign, Docker Hardened Images, and digest-based release gates.

Implement SIP first Container security overview

Control inputs

Agents, source, packages, and build context

Record evidence

SBOM, VEX, provenance, and signatures

Gate outputs

Scan and promote the same immutable digest

Understand the attack path

Modern worms move through maintainer accounts, lifecycle scripts, developer tools, caches, credentials, and trusted release pipelines.

Shai-Hulud

The Largest npm Supply Chain Attack

The package compromise, the Docker build implications, and concrete defensive controls.

Mini Shai-Hulud

The Next Evolution of npm Supply Chain Worms

A worm that adds Bun, IDE persistence, and coding-agent hooks to the package attack chain.

IX Hexbreaker

Beyond SLSA: Active Defense for CI/CD Worms

Why valid provenance is insufficient after a trusted build context is compromised, and how Aegis responds.

Apply immediate controls with SIP

SIP compresses the response into five controls that reinforce one another from the developer laptop to release promotion.

Canonical guide

SIP: Five Immediate Software Supply Chain Controls

Isolate agents, freeze dependencies, harden builds, generate attestations, and gate the exact image digest.

Package cooldowns

Delay Newly Published Dependencies

Use release-age policy, a committed lockfile, and disabled lifecycle scripts to reduce exposure to fresh compromises.

GitHub

SIP Reference Implementation

A working GitHub Actions implementation and sample application for the five controls.

Inventory every relevant build stage

An SBOM answers what is present. Generate it during the build so discarded build stages do not disappear from your evidence.

SBOM basics

Generating an SBOM with Docker Scout

Create and inspect a software bill of materials for a container image.

BuildKit

Signing Java SBOMs with Cosign

Capture multi-stage build inventory, understand in-toto attestations, and publish OCI referrers.

Scanner

Trivy

Scan container images and SBOMs for vulnerabilities, secrets, and misconfiguration.

Add context, provenance, and signatures

SBOM records inventory, VEX records vulnerability status, SLSA strengthens provenance, and Cosign verifies the artifact and attestations.

VEX

VEX Attestations and OCI Referrers

Attach reviewed vulnerability decisions to the same image without suppressing scanner findings globally.

SLSA

Where Provenance Helps—and Where It Stops

Use SLSA to strengthen the build while accounting for attacks that compromise the developer or CI context first.

Cosign

Sign Images and SBOM Attestations

Sign immutable digests, verify them, and make supply-chain evidence discoverable as OCI referrers.

Reduce attack surface and gate releases

Use minimal trusted inputs, scan evidence attached to an immutable digest, and promote that same digest only after policy passes.

DHI