1.0Veracodehttps://www.veracode.comBrian Rocherich600338<blockquote class="wp-embedded-content" data-secret="wNiG14bWoq"><a href="https://www.veracode.com/blog/securing-the-software-supply-chain-protecting-against-insecure-code-downloads/">Securing the Software Supply Chain: Protecting Against Insecure Code Downloads</a></blockquote><iframe sandbox="allow-scripts" security="restricted" src="https://www.veracode.com/blog/securing-the-software-supply-chain-protecting-against-insecure-code-downloads/embed/#?secret=wNiG14bWoq" width="600" height="338" title="“Securing the Software Supply Chain: Protecting Against Insecure Code Downloads” — Veracode" data-secret="wNiG14bWoq" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe><script type="text/javascript"> /* <![CDATA[ */ /*! This file is auto-generated */ !function(d,l){"use strict";l.querySelector&&d.addEventListener&&"undefined"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!/[^a-zA-Z0-9]/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),o=l.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),c=new RegExp("^https?:$","i"),i=0;i<o.length;i++)o[i].style.display="none";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute("style"),"height"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):"link"===t.message&&(r=new URL(s.getAttribute("src")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener("message",d.wp.receiveEmbedMessage,!1),l.addEventListener("DOMContentLoaded",function(){for(var e,t,s=l.querySelectorAll("iframe.wp-embedded-content"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute("data-secret"))||(t=Math.random().toString(36).substring(2,12),e.src+="#?secret="+t,e.setAttribute("data-secret",t)),e.contentWindow.postMessage({message:"ready",secret:t},"*")},!1)))}(window,document); /* ]]> */ </script> https://www.veracode.com/wp-content/uploads/2025/02/Veracoded-resources-900x473-1.webp900473Introduction In today's interconnected world, securing the software supply chain is crucial for maintaining robust application security. Developers often rely on package managers to import third-party code and libraries, but this convenience comes with risks. Insecure code downloads can introduce vulnerabilities that compromise the integrity of your software. In this blog post, we will explore essential steps to secure the supply chain and prevent developers from downloading insecure code from package managers.