Tag: supply-chain

Malware Security Announcements AI Engineering Technology Open Source SCA Compliance & SBOM CI/CD

Shai-Hulud Supply Chain Attack Incident Response

The Shai-Hulud supply chain attack is a major incident targeting developers through malicious packages in the npm ecosystem. This post outlines the incident response steps that can be taken to...

Malware

npm Supply Chain Attack: Multiple Popular Packages Hijacked (1B+ Weekly Downloads)

Complete analysis of sophisticated crypto wallet drainer found in 21 npm packages with over one billion weekly downloads. Includes detailed technical breakdown of 76KB malware payload disguised in...

Malware

npm Supply Chain Attack Exposes Private Repositories, AWS Credentials and More

npm supply chain attacks continue. This time targeting @ctrl/tinycolor and multiple other packages with credential stealer malware. In this blog, we will analyze the attack and its impact on the npm...

Open Source

Security Risks in PEP 723 and uv: Inline Metadata Gone Wrong?

PEP 723 introduces inline metadata for Python scripts, making tools like `uv` more convenient—but also potentially more dangerous. This post explores security pitfalls when dependencies are declared...