News,Press & Research

Go's decentralized module system and checksum verification reduce some supply chain risks familiar from npm. They do not establish whether a dependency is trustworthy: misleading module paths, repository ownership changes, and proxy-vs-source mismatches remain real attack vectors.

Work through three supply chain incident scenarios: a compromised dependency, a pull request crossing a trust boundary, and insider misuse. Includes a practical, two-page response checklist.

Six months ago, Boost acquired SecureIQx. Today we’re shipping the technology that team built, ThreatRank, inside Boost ASPM. ThreatRank tells you whether your code can reach each open-source CVE in a repository.

A scan of 1,386 developer laptops running commercial EDR found active malware on five of them, with no EDR alerts, plus 41,660 plaintext secrets the attackers could read. Here's what agentic coding tools add to that risk, and how to check your own laptop.

Dazio is a free tool from BoostSecurity that protects developers and their coding agents against software supply chain attacks. It blocks malicious packages before they install, finds the ones already on your machine, cleans up the secrets attackers are after, and hardens the tools you and your agents build with.We built it because we think the world needs one. Software development got dramatically faster; the safety net did not keep up.

See what Boost shipped this summer across developer endpoints, ASPM, package security, scanning, access controls, and developer workflows.

Software supply chain attacks are moving fast across developer endpoints, CI/CD pipelines, and open source ecosystems. Here’s what happened between April 30 and May 23—and what security teams should do about it.

Two acquisitions, one funding round, and a bigger platform: Boost adds Korbit.ai's AI-Native SAST and SecureIQx's reachability analysis to secure software factories running at machine speed.

In March 2026, TeamPCP unleashed mayhem on the software supply chain: compromising Trivy, LiteLLM, KICS, Telnyx, and dozens of npm packages, proving that CI/CD pipelines are the softest target. Today we're open-sourcing SmokedMeat, the first red team framework for build pipelines (i.e. CI/CD), so defenders can finally see the full kill chain for themselves.