Open Source

A supply chain attack exploited a GitHub Actions vulnerability, leading to a malicious release of the elementary-data package on PyPI. This incident highlights critical procurement implications for government agencies and contractors regarding software supply chain security and dependency management.

Agent-bom has launched version 0.80.1 of its open-source AI supply chain security scanner. This tool addresses growing procurement needs for strengthening security across complex environments, particularly in federal sectors looking to enhance compliance and remediation strategies.