software supply chain
"SBOMs describe what ends up in a piece of software, not how it got there. That distinction matters because..."
The malicious code creates a 'cascading compromise effect' into dependent ecosystems across npm's registry.
Protect yourself from malicious "phish" swimming upstream in OSS package consumption.
The malware "weaponized AI CLI tools (including Claude, Gemini, and q) to aid in reconnaissance and data exfiltration"
AWS has now "included additional protections against memory dumps within container builds..."
Google's new open source platform will shield popular dependencies with automations and data visibility tools.
Where are CISOs focusing and what makes a good one?
"These emails implored OpenJS to take action to update one of its popular JavaScript projects to ‘address any critical vulnerabilities'"