Tracking these is the floor. Preventing them is the point.
Most of these incidents end the same way...
01
Pin everything
Root pins every dependency in your container to a known-good, patched version. Newly-published malicious typosquats never enter the pinned set.
02
Patch without upgrading
When a real vulnerability lands, we backport the fix to the exact version you're pinned to. No breaking upgrades, no emergency triage.
03
Ship with zero CVEs
Every image we produce has zero known CVEs on release. Supply chain surface area drops to near zero.