The open source community relies on a loyal army of committed developers - but their security practices are putting the whole ecosystem at risk

The consequences of such heavy reliance upon individual developer accounts must not be discounted. For legal, bureaucratic, and security reasons, individual developers’ accounts have fewer protections associated with them than organizational accounts in a majority of cases.

A significant proportion of the top 500 packages identified in the investigation are hosted under individual developer accounts, which may lead to significant security vulnerabilities as these accounts often lack basic protections like multifactor authentication.

The report argued that FOSS has become a critical part of the modern economy, citing estimates that 96% of codebases include FOSS, thereby necessitating a reassessment of security for developers.

Compromised developer accounts pose significant threats, especially because many individual accounts fail to even have basic security protections, which makes them easy targets for attacks.

Read at ITPro