CVE-Based Scanners Miss the Fastest Supply-Chain Attacks, Analysts Warn

·61 views

Security scanners that rely on CVE databases are structurally blind to supply-chain attacks because a CVE can only be assigned after a flaw is discovered, catalogued, and published — a process that takes time attackers do not wait for. High-profile incidents including the event-stream npm compromise in 2018, the ua-parser-js hijack in 2021, and the polyfill.io domain sale in 2024 all caused damage before any CVE existed. Even xz-utils, which did receive CVE-2024-3094, had visible human warning signs — a new contributor slowly gaining trust and a tarball diverging from its git source — nearly a year before the identifier was assigned. Analysts argue that meaningful early detection requires monitoring project-level signals such as maintainer turnover, sudden drops in commit activity, ownership transfers, and artefact-to-source mismatches. These indicators consistently appear before an advisory is written and do not depend on a vulnerability number to be actionable.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hosting a three-repo security platform on free tiers: the bugs that surfaced

A developer built Sentinel, a self-hostable security monitoring platform split into an API, a dashboard, and a Python scanner, and documented the problems that emerged when moving it from local Docker Compose to free hosting services. Storing the refresh token in a SameSite=Strict cookie caused logouts on every reload across different hosted domains, and the developer avoided the tempting SameSite=None fix by routing requests through a same-origin proxy in the dashboard. A sign-in error was then traced to a relative-URL bug in the proxy mode that made every API call throw before being sent. The account also covers how a seed script's upsert design prevented admin password resets, leading to a one-off reset script.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ionify Explores Virtual Compiler Inputs to Avoid Full Tailwind Rescans

Ionify, an open-source frontend build tool, previously faced a Tailwind performance regression in which changing classes triggered a full rescan, raising build times from about 300ms to 1.3s in one workload. A first optimization cut the overhead by roughly 40 to 50 percent, prompting the developer to ask whether the unnecessary rescan could be eliminated entirely. Ionify's AI coding assistant advised a conservative approach, since changes can affect other inputs through dependencies, so scanning only the modified file is not automatically correct. The developer instead explored building a Virtual Input from the artifacts Tailwind's compiler needs, invalidating it only when correctness-relevant dependencies change. The work remains conceptual, with no guarantee that unrelated dependency changes can always be ignored.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tesla's Low-Advertising Growth Model Relies on Product Buzz and Brand Advocacy

Tesla has built strong brand awareness and sales with comparatively little traditional advertising, relying instead on its vehicles, launch events, distinctive design, and direct-sales model. The article argues this is not proof that advertising is unnecessary, but shows how product interest, customer advocacy, and earned media can drive demand. Tesla's 2025 annual report states it has historically sold vehicles at relatively low marketing cost while still monitoring its public narrative and investing in customer education and advertising when needed. The piece contends that products generating genuine conversation give customers and media material to spread the message themselves. It adds that this model only works when the product delivers real value, since hype without substance can damage long-term trust.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer details test suite for a high-concurrency Spring Boot e-commerce backend

A developer documented the testing and quality engineering approach used in ShopEase, a Spring Boot 3.x e-commerce backend built on Java 17. The strategy spans unit and slice tests for controllers and services, integration tests for cross-component database flows, and concurrency tests that simulate multi-threaded contention to prevent inventory overselling. Load and stress tests run through a custom Java concurrency harness to measure throughput and failure rates under heavy traffic. The author reports that the suite achieved a 100% build success rate across modules and thread-safe inventory handling.

0 comments Read more at DEV Community