OpenSSF

Mini Shai-Hulud: Where SLSA’s Boundaries Fall

The “Mini Shai-Hulud” attack chained a GitHub Actions workflow misconfiguration, cache poisoning, and OIDC token extraction to publish malicious packages through legitimate CI/CD pipelines.

The “Skyway” to OSS Security: OpenSSF Community Day North America 2026 Recap

The open source community recently gathered in Minneapolis for Open Source Summit North America and OpenSSF Community Day North America 2026. Functioning as a collaborative “Skyway,” the Open Source Security Foundation (OpenSSF) successfully brought together diverse working groups, security researchers, and enterprise maintainers to unify tooling, address artificial intelligence security transitions, and fortify the global…

Aligning on Machine-Readable Signals as the Foundation for Due Diligence

OpenSSF Newsletter – May 2026

What a month! May was packed with milestones for the OpenSSF community, and we're still riding the high from an incredible OpenSSF Community Day North America in Minneapolis. Read OpenSSF May Newsletter.

OpenSSF Notes Quarter of Growth with New Members, Added AI Security Resources, and Growing Community

Introducing the First Cohort of the OpenSSF Ambassador Program

Detecting Malicious Packages using the OSV API