
Vigilance — Sandbox
比较两个npm包版本以识别新增或更改的文件。
fathermarz · HN
I’ve worked in software supply-chain security for six years doing binary analysis on firmware, industrial controls systems, and commodity IT closed/open source software. What I learned is that in hopes to secure the software supply chain we have ran a very similar playbook and mostly over engineered the problem, with SBOMs and VEX documents and expected the industry to comply. But what was discovered was that every SBOM looks different depending on who produced it and at what step in the chain,










