Khi IDE Trở Thành Cửa Hậu: Tái Thiết AI Supply Chain Security Cho Doanh Nghiệp

When the IDE Becomes a Backdoor: Rebuilding AI Supply Chain Security for the Enterprise

1. Chẩn đoán rủi ro cụ thể Vụ một công cụ open source liên quan đến hệ sinh thái Microsoft bị tấn công để đánh cắp mật khẩu của AI...

1. Specific risk diagnosis The incident in which an open-source tool connected to the Microsoft ecosystem was compromised to steal AI developers’ passwords is a clear warning: the weak point...

#!/usr/bin/env bash
set -euo pipefail

# Generate SBOM for Python/Node projects
pip install cyclonedx-bom pip-audit >/dev/null 2>&1 || true
cyclonedx-py environment -o sbom-python.json

if [ -f package-lock.json ]; then
  npx @cyclonedx/cyclonedx-npm --output-file sbom-node.json
fi

# Basic dependency risk checks
pip-audit -r requirements.txt || true
npm audit --audit-level=high || true

# Store SBOM as CI artifact, not only local file
ls -lh sbom-*.json

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.4
    hooks:
      - id: gitleaks

# Install and enable
pip install pre-commit
pre-commit install
pre-commit run --all-files

# GitHub Actions: secret scan on pull request
name: secret-scan
on: [pull_request]
jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# Example: pin GitHub Action by commit SHA instead of floating tag
# Risky:
# - uses: vendor/some-action@v1

# Safer:
- uses: vendor/some-action@3f4c2a9b8d1e6a7c9a2b6e0c123456789abcdef0

# Example: Python dependency pinning with hashes
pip-compile --generate-hashes requirements.in
pip install --require-hashes -r requirements.txt

#!/usr/bin/env bash
set -euo pipefail

# Generate SBOM for Python/Node projects
pip install cyclonedx-bom pip-audit >/dev/null 2>&1 || true
cyclonedx-py environment -o sbom-python.json

if [ -f package-lock.json ]; then
  npx @cyclonedx/cyclonedx-npm --output-file sbom-node.json
fi

# Basic dependency risk checks
pip-audit -r requirements.txt || true
npm audit --audit-level=high || true

# Store SBOM as CI artifact, not only local file
ls -lh sbom-*.json

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.4
    hooks:
      - id: gitleaks

# Install and enable
pip install pre-commit
pre-commit install
pre-commit run --all-files

# GitHub Actions: secret scan on pull request
name: secret-scan
on: [pull_request]
jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# Example: pin GitHub Action by commit SHA instead of floating tag
# Risky:
# - uses: vendor/some-action@v1

# Safer:
- uses: vendor/some-action@3f4c2a9b8d1e6a7c9a2b6e0c123456789abcdef0

# Example: Python dependency pinning with hashes
pip-compile --generate-hashes requirements.in
pip install --require-hashes -r requirements.txt