#software supply chain
#software supply chain
[ follow ]
#software-supply-chain #npm #cybersecurity #sbom #security #open-source #container-security #open-source-security
fromComputerworld
1 month agoJamf has a warning for macOS vibe coders
But like everything else in life, there will always be a more powerful AI waiting in the wings to take out both protagonists and open a new chapter in the fight. Acclaimed author and enthusiastic Mac user Douglas Adams once posited that Deep Thought, the computer, told us the answer to the ultimate question of life, the universe, and everything was 42, which only made sense once the question was redefined. But in today's era, we cannot be certain the computer did not hallucinate.
Artificial intelligence
#npm
Information security
fromSecuritymagazine
5 months ago2B Weekly Downloads at Risk: Supply Chain Attack Targets Popular npm Packages, Security Leaders Discuss
Eighteen widely used npm packages were compromised via a maintainer's phishing-induced 2FA breach, risking a supply-chain attack across millions of weekly downloads.
Information security
fromThe Hacker News
5 months ago20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack
Phished npm maintainer led to malicious updates in 20 popular packages that steal cryptocurrency by intercepting and rewriting transaction requests to attacker wallets.
Information security
fromArs Technica
1 month agoSupply chains, AI, and the cloud: The biggest failures (and one success) of 2025
Supply-chain attacks surged in 2024–2025, allowing attackers to compromise single targets and infect thousands or millions of downstream users, causing widespread theft and outages.
fromDeveloper Tech News
2 months agoSoftware development in 2026: Curing the AI party hangover
In 2026, generative AI stops being an experiment for software development and starts being an architectural liability. The initial rush to apply AI everywhere is hardening into a struggle with execution, where the primary hurdles are no longer capability, but control, cost, and security. We are already seeing the cracks in code integrity. As AI-assisted development becomes standard, the volume of code produced is outpacing human capacity to audit it. This "vibe coding" prioritises speed over structural soundness, creating a new category of technical debt.
Software development
Information security
fromWIRED
4 months agoVibe Coding Is the New Open Source-in the Worst Way Possible
AI-generated vibe coding speeds development but can reproduce existing and new vulnerabilities, increasing software-supply-chain risk and demanding revised development lifecycles and rigorous human review.
Software development
fromTheregister
4 months agoKroah-Hartman explains Cyber Resilience Act for open source
The EU Cyber Resilience Act largely protects individual open-source contributors while placing documentation, SBOM, vulnerability-tracking, and transparency obligations on product-producing organizations.
fromTheregister
5 months agoOpenSSF to freeloaders: Open source infra isn't free
A coalition of heavyweight open source foundations issued a joint statement via the foundation on Tuesday, declaring that "open infrastructure is not free" and warning that the critical machinery behind modern software development is being stretched to breaking point. Package registries like Maven Central, PyPI, crates.io, npm, and Packagist handle billions of downloads every month, yet the organizations running them are often scraping by on donations, grants, and the goodwill of a few sponsors.
Software development
fromInfoWorld
5 months agoJFrog announces 'agentic repo' for AI-driven development
JFrog has introduced JFrog Fly, an offering the company describes as a zero-config, "agentic repository" for accelerating AI-driven software development. Introduced September 9, JFrog Fly is intended to support agentic workflows for development teams. AI agents orchestrate artifacts across the software life cycle, enabling developers to focus on delivering software to production with speed and scale, according to JFrog. Developers can join a beta waitlist for JFrog Fly.
Artificial intelligence
Artificial intelligence
fromDevOps.com
5 months agoJFrog CEO: AI Agents Require Practices Beyond Security, Traceability - DevOps.com
Foundational software platforms must embed agentic AI practices, security, traceability, and a single system of record to manage AI-driven development and supply-chain risk.
fromDevOps.com
8 months agoJFrog Extends Alliance With NVIDIA to Secure AI Software Supply Chain - DevOps.com
JFrog and NVIDIA have expanded integrations to include the Enterprise AI Factory, enabling the management of AI applications through JFrog's Software Supply Chain Platform.
Artificial intelligence
[ Load more ]