When Your Security Tool Goes Down: Surviving an SCA Tool Outage

Sun, 12 Apr 2026 00:00:00 +0000

Security tooling exists to protect your organization. But what happens when the security tool itself becomes the outage?

That’s the situation we found ourselves in when an SCA tool experienced a service disruption that lasted approximately five hours. For us, it wasn’t a degraded experience; it was a complete development freeze.

Supply Chain Attacks Start in Your Build Cache

Sat, 11 Apr 2026 00:00:00 +0000

On March 25, 2025, a malicious version of the axios npm package (version 1.14.1) was published to the npm registry. It contained a bundled dependency called plain-crypto-js@4.2.0, which was later confirmed to be malicious. The package was identified and removed from the npm registry within roughly three hours.

For most organizations, three hours sounds manageable. For us, it wasn’t that simple.

Supply Chain on Cliff Hults

When Your Security Tool Goes Down: Surviving an SCA Tool Outage

Supply Chain Attacks Start in Your Build Cache