Security lens · Build and supply chain

Pinned and verified dependencies

A newly published malicious version of a package is not pulled in automatically, and a tampered build is easier to tell from the real one.

Where to start

Our reading of the guidance below, for a small team. A starting point, not a complete program.

Commit lockfiles and install from them in every build, so only versions already checked are used.
Update dependencies on purpose, after a check, rather than taking the newest release automatically.
Where a package publishes build provenance, verify it before that package ships in your product.

The guidance

OWASP · Software Supply Chain Security Cheat Sheet
To reduce the likelihood that a compromised or vulnerable version is unwittingly pulled into an application, one should limit the applications dependencies to a specific version that has been previously verified as legitimate and secure.
SLSA · SLSA v1.2: Tracks
The primary purpose of the build track is to enable verification that the artifact was built as expected.

Short quotes from the official guidance, linked. Read the source before you act on it.

Incidents from the Drops

SecurityOct 31, 2026

Polymarket traders lose over $2 million through a compromised third-party script

Polymarket says a third-party provider was compromised; researchers tie it to DebugBear's monitoring script, which used logged-in sessions to sell positions or move tokens. Loss estimates: $2.19 million to $2.71 million.

Why it matters: A third-party script on a logged-in page acts with your users' authority. List the outside scripts your app loads and pin, self-host or drop them.

Confirmed Way in: a compromised third-party monitoring script loaded on the logged-in trading site

Controls that would have helped:

SecurityWeek · Oct 30

From Drop #058 · Sat, Oct 31, 2026 · Evening

SecurityOct 31, 2026Following since Oct 30, 2026in 2 Drops

Cursor: backdoored Claude Code extension reached at most 5,000 users; two versions hit

Phorion's updated write-up says Cursor now names versions 2.1.312 and 2.1.313 as affected. Ars Technica says Cursor put the exposure at no more than 5,000 users and that Anthropic had not yet publicly warned customers.

Why it matters: Cursor extensions auto-update by default, Phorion's CTO told Ars. If you installed or updated it on Thursday, check the listed indicators and rotate keys that machine held.

Confirmed Way in: a malicious extension update published through the vendor's official marketplace account

Controls that would have helped:

Ars Technica · Oct 30 Phorion · Oct 31 Hacker News · Oct 30

From Drop #057 · Sat, Oct 31, 2026 · Morning