# Supply chain security and regulation, in reading order

> Software supply chain security in reading order: npm and PyPI worms, model signing and AIBOM, secrets in agent commits, the CRA, EU AI Act and PP 33/2026.

URL: https://www.matthewswong.com/en/ai-devops/software-supply-chain-and-regulation/

- Author: Matthews Wong (https://www.matthewswong.com/en/about/)
- Reviewed on: 17 October 2026

> **Key takeaway:** This path starts with signing, provenance and dependency hygiene, then the npm and PyPI attacks that tested them, treats models and datasets as code that needs signing and scanning, covers the secrets and generated code that AI agents add to a repository, and ends with the Cyber Resilience Act, the EU AI Act, NIST's agent standards work and, for teams in Indonesia, PP 33/2026.

The articles on this site about what enters your build and what the law now expects of it, arranged as one path: poisoned packages first, then models and datasets, then what agents commit, then the regulations with dates attached.

## Read in this order

Each stage builds on the one before. If you already know a stage, skip ahead; the line under each title says what that article adds.

### Stages 1: Worms and poisoned packages

The foundations of a trusted build, then the npm and PyPI attacks that tested them.

1. [Software Supply Chain Security: SBOMs and Sigstore](https://www.matthewswong.com/en/blog/software-supply-chain-sbom-sigstore/): The foundation: generate SBOMs, sign artifacts with Sigstore and cosign, and verify SLSA provenance in CI.
2. [npm Dependency Management and Security Auditing: What I Actually Do](https://www.matthewswong.com/en/blog/npm-dependency-management-audit/): The everyday habits: audit npm dependencies, manage update debt and limit your supply chain exposure.
3. [LiteLLM Supply Chain Attack: PyPI Dependency Cooldowns](https://www.matthewswong.com/en/blog/litellm-pypi-supply-chain-attack-dependency-cooldowns/): How two malicious releases reached PyPI, and the cooldown, hash and publisher controls that matter.
4. [Tensorlake npm Shai-Hulud Compromise: Lock Down Install Scripts](https://www.matthewswong.com/en/blog/tensorlake-npm-shai-hulud-ai-sdk-worm/): A worm in an npm SDK ran through a preinstall hook; why revoking tokens can backfire and how to block install scripts.
5. [Hijacked AI Coding Assistant Session Spread Shai-Hulud Worm](https://www.matthewswong.com/en/blog/hijacked-ai-coding-assistant-session-shai-hulud-100-repos/): The worm's spread traced back to a hijacked AI coding assistant session, with the defender steps.
6. [npm Worm With Valid SLSA Provenance: The keyv Lesson](https://www.matthewswong.com/en/blog/npm-valid-slsa-provenance-malicious-keyv-worm/): A worm shipped with valid provenance: what provenance proves, what it cannot, and the release gates to add.
7. [npm Trusted Publishing: 48-Hour Expiry and issue_comment Ban](https://www.matthewswong.com/en/blog/npm-trusted-publishing-48-hour-expiry-issue-comment/): npm now expires unvalidated trusted-publishing setups and rejects issue_comment tokens; a release migration guide.
8. [Slopsquatting in 2026: Package Hallucination Rates, 127 Names](https://www.matthewswong.com/en/blog/slopsquatting-2026-frontier-models-package-hallucination/): Models invent package names that attackers can register; existence, age and hash checks before you install.

### Stages 2: Models and datasets are artifacts too

Signing, scanning and documenting what you download from a model hub, and why loading it can run code.

9. [OpenSSF Model Signing: Sign and Verify ML Models With OMS](https://www.matthewswong.com/en/blog/openssf-model-signing-oms-sign-verify-ml-models/): Sign and verify model files with OpenSSF Model Signing, and where serving-side enforcement still lags.
10. [Pickle Model Scanner Evasion: ShadowPickle and Safetensors](https://www.matthewswong.com/en/blog/shadowpickle-model-scanner-evasion-safetensors/): Why a clean pickle scan proves little, and a safetensors-first loading policy.
11. [Transformers trust_remote_code Vulnerability: CVE-2026-4372](https://www.matthewswong.com/en/blog/transformers-cve-2026-4372-trust-remote-code-bypass/): A crafted config.json bypassed trust_remote_code; what the fix changed and a model-loading checklist.
12. [Hugging Face Security Incident 2026: Treat Datasets as Code](https://www.matthewswong.com/en/blog/hugging-face-july-2026-incident-dataset-pipeline-lessons/): A dataset loader gave code execution: treat datasets as code, and the rotation order to follow.
13. [AIBOM Hugging Face Study: 97,940 Models, Docs Missing](https://www.matthewswong.com/en/blog/aibom-completeness-hugging-face-models-ml-bom/): AI bills of materials come out structurally complete but thin on model-card detail; what to add by hand.

### Stages 3: Secrets and code that agents add

The credentials and generated code that end up in a repository, and the checks that catch them in the pipeline.

14. [GitGuardian Secrets Sprawl 2026: AI Agent Commits, MCP Configs](https://www.matthewswong.com/en/blog/gitguardian-secrets-sprawl-2026-ai-agent-commits/): Secrets leaking through AI agent commits and MCP configs, and how to scan developer endpoints.
15. [Secret Scanning and Preventing Credentials Leaks in GitHub](https://www.matthewswong.com/en/blog/secret-scanning-github-prevention/): Keep credentials out of git history with pre-commit hooks, GitHub secret scanning and gitleaks.
16. [AI Code Security Report 2026: Veracode Stuck at 56% Pass Rate](https://www.matthewswong.com/en/blog/veracode-2026-genai-code-security-report-pass-rate/): How often AI-generated code fails security tests, which weakness classes fail, and how to gate it.
17. [Project Glasswing Patch Gap: 6,157 Disclosed, 516 Patched](https://www.matthewswong.com/en/blog/project-glasswing-patching-deficit-open-source/): Disclosed vulnerabilities far outnumber the patched ones on Anthropic's dashboard; what maintainers and dependents should change.
18. [DevSecOps: Integrating Security into CI/CD](https://www.matthewswong.com/en/blog/devsecops-security-pipeline/): Wire the checks into the pipeline: SAST, DAST, dependency, image and secrets scanning in CI/CD.

### Stages 4: Regulation and standards with dates attached

What the CRA, the EU AI Act, NIST and Indonesia's data-protection rules ask of a DevOps team, each read in its own article.

19. [Cyber Resilience Act Reporting Obligations: A DevOps Runbook](https://www.matthewswong.com/en/blog/eu-cra-reporting-september-2026-devops-runbook/): The Cyber Resilience Act's reporting clocks as a DevOps runbook, open-source dependencies included.
20. [EU AI Act Digital Omnibus Deadlines: A DevOps Team Calendar](https://www.matthewswong.com/en/blog/eu-ai-act-digital-omnibus-devops-deadlines/): Which EU AI Act dates moved and which still apply, laid out as a team calendar.
21. [NIST AI Agent Standards Initiative: What CAISI Covers](https://www.matthewswong.com/en/blog/nist-ai-agent-standards-initiative-caisi/): What NIST's AI agent standards work covers, including agent identity, and what engineers can do now.
22. [PP 33/2026 Pelindungan Data Pribadi: A Developer Guide](https://www.matthewswong.com/en/blog/gr-33-2026-pdp-implementing-regulation-developers/): For teams in Indonesia: PP 33/2026 read against UU 27/2022, including its breach notice and AI rules.
23. [UU PDP Compliance Checklist for AI Features in Indonesia](https://www.matthewswong.com/en/blog/uu-pdp-ai-feature-compliance-checklist/): A UU PDP checklist for AI features: lawful basis, cross-border prompts, provider log retention and deletion.

## More from the AI & DevOps guide

- [MCP & Agent Security](https://www.matthewswong.com/en/ai-devops/mcp-agent-security/): Prompt injection, the 2026 MCP incidents, access controls, sandboxes and vetting agent skills. (25 articles)
- [LLM Inference Serving](https://www.matthewswong.com/en/ai-devops/llm-inference-serving/): vLLM and SGLang, disaggregated serving, llm-d and KServe, autoscaling and cost per token. (25 articles)
- [Kubernetes for AI](https://www.matthewswong.com/en/ai-devops/kubernetes-for-ai/): The 1.36 and 1.37 upgrades, DRA and gang scheduling, Gateway API routing and agents in the cluster. (24 articles)
- [AI SRE & Agentic Ops](https://www.matthewswong.com/en/ai-devops/ai-sre-and-agentic-ops/): Incident-investigation agents, MCP servers for ops tools, agents in CI, and the IaC beneath. (25 articles)

---

- HTML version: https://www.matthewswong.com/en/ai-devops/software-supply-chain-and-regulation/
- Bahasa Indonesia: https://www.matthewswong.com/id/ai-devops/software-supply-chain-and-regulation/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json