software supply chain
"If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, ini, body-parser), Axios will automatically..."
Individual OSS developers are being targeted by nation states…
“This is among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package."
"GitHub’s Immutable badge was intended as a trust signal..."
The software supply chain startup is also now working with ISVs like Elastic and GitLab to harden their software as well as OSS.
"SBOMs describe what ends up in a piece of software, not how it got there. That distinction matters because..."
The malicious code creates a 'cascading compromise effect' into dependent ecosystems across npm's registry.
Protect yourself from malicious "phish" swimming upstream in OSS package consumption.
The malware "weaponized AI CLI tools (including Claude, Gemini, and q) to aid in reconnaissance and data exfiltration"