#software supply chain tag

3 days ago

Bringing Trust and Governance to AI-Driven DevOps - DevOps.com

AI is transforming DevOps by reshaping productivity, security, and software supply chains, requiring trust, verification, and alignment with practitioner experience.

fromInfoWorld

5 days ago

JFrog announces 'agentic repo' for AI-driven development

JFrog has introduced JFrog Fly, an offering the company describes as a zero-config, "agentic repository" for accelerating AI-driven software development. Introduced September 9, JFrog Fly is intended to support agentic workflows for development teams. AI agents orchestrate artifacts across the software life cycle, enabling developers to focus on delivering software to production with speed and scale, according to JFrog. Developers can join a beta waitlist for JFrog Fly.

Artificial intelligence

#npm

Information security

2B Weekly Downloads at Risk: Supply Chain Attack Targets Popular npm Packages, Security Leaders Discuss

Information security

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Information security

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Information security

2B Weekly Downloads at Risk: Supply Chain Attack Targets Popular npm Packages, Security Leaders Discuss

Information security

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Information security

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

more#npm

Artificial intelligence

JFrog CEO: AI Agents Require Practices Beyond Security, Traceability - DevOps.com

Foundational software platforms must embed agentic AI practices, security, traceability, and a single system of record to manage AI-driven development and supply-chain risk.

#software-supply-chain

Artificial intelligence

JFrog Continues Leaping at SwampUP - DevOps.com

Information security

The Top Threats Undermining the Security of Software Supply Chains

Information security

DoD reportedly relies on utility written by Russian

Information security

Nx NPM packages poisoned in AI-assisted supply chain attack

fromNextgov.com

Information security

Report: Russia-based Yandex employee oversees open-source software approved for DOD use

Software development

The Quantum Shift Is Here: A Survival Guide for the New Era of Software - DevOps.com

Artificial intelligence

JFrog Continues Leaping at SwampUP - DevOps.com

Information security

The Top Threats Undermining the Security of Software Supply Chains

Information security

DoD reportedly relies on utility written by Russian

Information security

Nx NPM packages poisoned in AI-assisted supply chain attack

fromNextgov.com

Information security

Report: Russia-based Yandex employee oversees open-source software approved for DOD use

more#software-supply-chain

Software development

The Quantum Shift Is Here: A Survival Guide for the New Era of Software - DevOps.com

#sbom

3 weeks ago

Information security

CISA Issues Software Bill of Materials Draft, Encourages Public Comments

Information security

Survey Surfaces Uneven Adoption of SBOMs to Secure Software - DevOps.com

3 weeks ago

Information security

CISA Issues Software Bill of Materials Draft, Encourages Public Comments

Information security

Survey Surfaces Uneven Adoption of SBOMs to Secure Software - DevOps.com

more#sbom

Privacy professionals

1 month ago

Google Launches OSS Rebuild to Expose Malicious Code in Widely Used Open-Source Packages

OSS Rebuild enhances the security of open-source package ecosystems to prevent software supply chain attacks.

#ai

fromTechzine Global

1 month ago

DevOps

JFrog launches MCP Server for AI-driven development workflows

JFrog's MCP Server enhances developer productivity by integrating AI capabilities into coding environments.

fromWIRED

Artificial intelligence

AI Code Hallucinations Increase the Risk of 'Package Confusion' Attacks

AI-generated code often references non-existent third-party libraries, posing risks for supply-chain attacks.

fromTechzine Global

1 month ago

DevOps

JFrog launches MCP Server for AI-driven development workflows

Artificial intelligence

fromWIRED

fromApp Developer Magazine

AI Code Hallucinations Increase the Risk of 'Package Confusion' Attacks

AI-generated code often references non-existent third-party libraries, posing risks for supply-chain attacks.

North Korean Hackers Flood npm Registry with XORIndex Malware in Ongoing Attack Campaign

North Korean threat actors are deploying malicious npm packages as part of ongoing software supply chain attacks against the open-source ecosystem.

Software development

8 months ago

2025 Artifact Management Report

Artifact management has shifted to a strategic priority, focusing on security vulnerabilities in complex software environments.

#cybersecurity

fromCSO Online

2 months ago

Information security

Malicious PyPI package targets Chimera users to steal AWS tokens, CI/CD secrets

Software development

Checkmarx Surfaces Malicious Effort to Compromise Software Supply Chains - DevOps.com

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

fromCSO Online

2 months ago

Information security

Malicious PyPI package targets Chimera users to steal AWS tokens, CI/CD secrets

Software development

Checkmarx Surfaces Malicious Effort to Compromise Software Supply Chains - DevOps.com

New malware targets application developers through typo-squatting, aiming to compromise software supply chains by providing persistent access and data exfiltration.

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

more#cybersecurity

JFrog Extends Alliance With NVIDIA to Secure AI Software Supply Chain - DevOps.com

JFrog and NVIDIA have expanded integrations to include the Enterprise AI Factory, enabling the management of AI applications through JFrog's Software Supply Chain Platform.

Artificial intelligence

DevOps

fromInfoQ

Docker Introduces Hardened Images to Strengthen Container Security

Docker's Hardened Images significantly enhance container security by reducing attack surfaces and minimizing vulnerabilities.

DevOps