Back to article
blog.packagist.com

An Update on Composer and Packagist Supply Chain Security (opens in new tab)

Covers 4 stories See all stories this covers including Staged publishing and new install-time controls for npmCovered by 5 sources See all sources covering this story including Andrew Nesbitt, DEV CommunityDiscussed on Hacker News

Covers 4 related stories

github.blog·

Staged publishing and new install-time controls for npm

Discussed on Hacker News and Lobsters
Feeds
Aikido Security's Blog·

Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer

Discussed on Hacker News
Feeds
slsa.dev·

SLSA • Supply-chain Levels for Software Artifacts

Feeds
sigstore.dev·

Sigstore: Making sure your software is what it claims to be

Discussed on Hacker News
Feeds

Covered in 6 articles

Andrew Nesbitt·

This Week in Package Management: 30 May 2026

Feeds
Andrew Nesbitt·

Composer’s dependency policies

Discussed on Hacker News
Feeds
DEV Community·

Composer Update Is Not Safe Anymore

Discussed on DEV
Feeds
risky.biz·

Risky Bulletin: Russia greatly expands SORM surveillance requirements

Discussed on Hacker News
Feeds
news.risky.biz·

Risky Bulletin: Russia greatly expands SORM surveillance requirements

Feeds
laravel-news.com·

Malware Blocking and Dependency Policies in Composer 2.10

Feeds

Keyboard Shortcuts

Navigation

Next / previous post
j/k
Open post
oorEnter
Preview post
v

Post Actions

Love post
a
Like post
l
Dislike post
d
Undo reaction
u
Save / unsave
s

Recommendations

Add interest / feed
Enter
Not interested
x

Go to

Home
gh
Interests
gi
Feeds
gf
Likes
gl
History
gy
Changelog
gc
Settings
gs
Discover
gb
Search
/

General

Show this help
?
Submit feedback
!
Close modal / unfocus
Esc

Press ? anytime to show this help