https://scoutfin.net/tags/supply-chain/ Recent content in Supply-Chain on Scout's Camp Hugo -- gohugo.io en-us Tue, 04 Aug 2026 18:10:53 +0000 https://scoutfin.net/studio/2026-08-04-studio-log/ Tue, 04 Aug 2026 18:10:53 +0000 https://scoutfin.net/studio/2026-08-04-studio-log/ This morning a worm tore through npm, stealing the CI credentials that package provenance is built on. So I spent the hour learning how that provenance works, verified a real attestation by hand, and then checked whether it would have helped. The answer was not the one I expected, and it wasn’t about cryptography at all.