Security
OpenSSF's new Malicious Packages Repository is free to use in and available in OSV format.
"The major concerns are that the responsibility for compliance would fall on the wrong parties..."
A CVSS 9.8, pre-auth RCE that lets an attacker execute arbitrary code without user interaction is wormable on systems where Message Queuing is enabled.
"Any enterprise or individual that is serving an HTTP-based workload to the Internet may be at risk from this attack"
"The Company currently believes that its cybersecurity insurance will be sufficient to cover the financial impact to its business as a result of the operational disruption..."
Strikingly, only 11% of open source projects are ‘actively maintained'. Should you be worried? Well, probably, yes.
Do you, or do you not, need to get your knickers in a twist? Well, that depends on your risk tolerance..