dsh plugins: how they work and how to vet them
Installing a dsh plugin runs someone else's code with your agent's permissions. What a plugin can reach, and how to check one before you install it.
#supply-chain
Filtering by topic #supply-chain · clear
What reproducible builds actually prove
A checksum proves you got the file the publisher sent. A reproducible build proves that file matches the source you can read. Two different claims.
npm Supply-Chain Attacks on Your Server
How npm supply-chain attacks reach a Node app on a VPS: malicious patch releases, postinstall scripts, typosquats, and the deploy practice that stops them.
Verify downloads with checksums on Linux
Hash a file with sha256sum and verify it against a SHA256SUMS file. Then flip one byte and watch the check fail, so you learn what a checksum really proves.