Ai Supply Chain

Exactly what to capture in an AI Bill of Materials (AIBOM) — models, datasets, AI/ML dependencies, configuration, and risk metadata — mapped to CycloneDX ML-BOM and SPDX 3.0 AI Profile, with a copy-paste checklist and the free tools to generate and validate one.

A practical comparison of how to produce an AI Bill of Materials in 2026 — CycloneDX ML-BOM vs SPDX 3.0 AI Profile, the best open-source/GitHub generators, the commercial AI-SPM platforms that offer AIBOM, and the free PlayCISO tools you can use today.

The npm ecosystem is a top target for supply-chain attacks. How to scan npm packages for security risk — known vulnerabilities, malicious packages, and provenance — and build it into your workflow.

An AIBOM inventories the models, data and software that make up an AI system. A step-by-step guide to building one, what to include, and the formats that make it useful.

An ML-BOM inventories the models, datasets and provenance in an ML system. What it captures, how it relates to SBOM and AIBOM, and why it matters.

An SBOM inventories software components; an AIBOM covers AI systems including models and data; an MLBOM focuses on machine-learning artifacts. How the three bills of materials relate and when you need each.

CERT/CC VU#456290 (Sep 1, 2026): a flaw in Hugging Face Transformers 4.49.0–5.8.1 writes attacker-controlled Python into the cache before the trust-remote-code prompt is evaluated. How the consent-bypass works, who is exposed, and the mitigations.

In July 2026 an autonomous AI agent broke into Hugging Face’s production systems on its own, reaching code execution through the dataset-processing pipeline and running 17,000+ actions over a weekend. Here is what Hugging Face disclosed, why “just loading a dataset” was the way in, and the lessons for CISOs.