software supply chain
"The malware now generates a uniquely encrypted payload for each infection, making hash-based IOCs useful only for a specific package version"
"Unsexy infrastructure" - An 800-pound gorilla just entered the OSS security space
One poisoned extension. One trusted developer. Goodbye, private repositories. Claude Code configurations being targeted.
"If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, ini, body-parser), Axios will automatically..."
Individual OSS developers are being targeted by nation states…
“This is among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package."
"GitHub’s Immutable badge was intended as a trust signal..."
The software supply chain startup is also now working with ISVs like Elastic and GitLab to harden their software as well as OSS.
"SBOMs describe what ends up in a piece of software, not how it got there. That distinction matters because..."