#software supply chain
#software supply chain

2 days ago

'Highly sophisticated' government goons hacked F5

Nation-state hackers breached F5, stealing BIG-IP source code, undisclosed vulnerability details, and some customers' configuration data while maintaining long-term access.

#software-supply-chain

2 days ago

Information security

Over 100 VS Code Extensions Exposed Developers to Hidden Supply Chain Risks

5 days ago

Information security

60% of Security Leaders Say Threat Actors Are Evolving Too Quickly

JavaScript

Chainguard offers malware-resistant JavaScript libraries

Information security

First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package

Chainguard Adds Curated Repository to Secure JavaScript Libraries - DevOps.com

Chainguard provides curated, SLSA-built JavaScript libraries as containerized artifacts to reduce malware risk in JavaScript software supply chains.

NPM attacks and the security of software supply chains

Process improvements and sustainable funding provide far more protection for open-source software supply chains than isolated technical guardrails.

2 days ago

Information security

Over 100 VS Code Extensions Exposed Developers to Hidden Supply Chain Risks

5 days ago

Information security

60% of Security Leaders Say Threat Actors Are Evolving Too Quickly

JavaScript

Chainguard offers malware-resistant JavaScript libraries

Information security

First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package

Information security

Chainguard Adds Curated Repository to Secure JavaScript Libraries - DevOps.com

more#software-supply-chain

Information security

NPM attacks and the security of software supply chains

fromWIRED

1 week ago

Vibe Coding Is the New Open Source-in the Worst Way Possible

AI-generated vibe coding speeds development but can reproduce existing and new vulnerabilities, increasing software-supply-chain risk and demanding revised development lifecycles and rigorous human review.

Kroah-Hartman explains Cyber Resilience Act for open source

The EU Cyber Resilience Act largely protects individual open-source contributors while placing documentation, SBOM, vulnerability-tracking, and transparency obligations on product-producing organizations.

EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations

Threat actors hide malware inside legitimate-seeming AI and productivity tools, distributing the EvilAI campaign globally across sectors to enable stealthy, future attacks.

#open-source

Software development

Just using open source isn't radical any more, Europe

2 months ago

Privacy professionals

Google Launches OSS Rebuild to Expose Malicious Code in Widely Used Open-Source Packages

Software development

Just using open source isn't radical any more, Europe

2 months ago

Privacy professionals

Google Launches OSS Rebuild to Expose Malicious Code in Widely Used Open-Source Packages

more#open-source

OpenSSF to freeloaders: Open source infra isn't free

A coalition of heavyweight open source foundations issued a joint statement via the foundation on Tuesday, declaring that "open infrastructure is not free" and warning that the critical machinery behind modern software development is being stretched to breaking point. Package registries like Maven Central, PyPI, crates.io, npm, and Packagist handle billions of downloads every month, yet the organizations running them are often scraping by on donations, grants, and the goodwill of a few sponsors.

Software development

fromFuturism

CrowdStrike Infested With "Self-Replicating Worms"

A self-replicating NPM worm named Shai-Hulud stole access tokens to compromise maintainer accounts and propagate across hundreds of packages, including CrowdStrike-managed modules.

Sketch Coding and the Rise of MCP in DevOps - DevOps.com

Developer-focused culture and hands-on coding drive JFrog's innovation, blending AI, DevOps, and open source to create scalable, secure software supply chain tools.

Artificial intelligence

Bringing Trust and Governance to AI-Driven DevOps - DevOps.com

AI is transforming DevOps by reshaping productivity, security, and software supply chains, requiring trust, verification, and alignment with practitioner experience.

JFrog announces 'agentic repo' for AI-driven development

JFrog has introduced JFrog Fly, an offering the company describes as a zero-config, "agentic repository" for accelerating AI-driven software development. Introduced September 9, JFrog Fly is intended to support agentic workflows for development teams. AI agents orchestrate artifacts across the software life cycle, enabling developers to focus on delivering software to production with speed and scale, according to JFrog. Developers can join a beta waitlist for JFrog Fly.

Artificial intelligence

#npm

Information security

2B Weekly Downloads at Risk: Supply Chain Attack Targets Popular npm Packages, Security Leaders Discuss

Information security

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Information security

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Information security

2B Weekly Downloads at Risk: Supply Chain Attack Targets Popular npm Packages, Security Leaders Discuss

Information security

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Information security

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

more#npm

Artificial intelligence

JFrog CEO: AI Agents Require Practices Beyond Security, Traceability - DevOps.com

Foundational software platforms must embed agentic AI practices, security, traceability, and a single system of record to manage AI-driven development and supply-chain risk.

#sbom

Information security

CISA Issues Software Bill of Materials Draft, Encourages Public Comments

Information security

Survey Surfaces Uneven Adoption of SBOMs to Secure Software - DevOps.com

Information security

CISA Issues Software Bill of Materials Draft, Encourages Public Comments

Information security

Survey Surfaces Uneven Adoption of SBOMs to Secure Software - DevOps.com

DevOps

JFrog launches MCP Server for AI-driven development workflows

JFrog's MCP Server enhances developer productivity by integrating AI capabilities into coding environments.

fromWIRED

Artificial intelligence

AI Code Hallucinations Increase the Risk of 'Package Confusion' Attacks

AI-generated code often references non-existent third-party libraries, posing risks for supply-chain attacks.

fromTechzine Global

3 months ago

DevOps

JFrog launches MCP Server for AI-driven development workflows

Artificial intelligence

fromWIRED

AI Code Hallucinations Increase the Risk of 'Package Confusion' Attacks

AI-generated code often references non-existent third-party libraries, posing risks for supply-chain attacks.

North Korean Hackers Flood npm Registry with XORIndex Malware in Ongoing Attack Campaign

North Korean threat actors are deploying malicious npm packages as part of ongoing software supply chain attacks against the open-source ecosystem.

fromApp Developer Magazine

9 months ago

2025 Artifact Management Report

Artifact management has shifted to a strategic priority, focusing on security vulnerabilities in complex software environments.

#cybersecurity

fromCSO Online

Information security

Malicious PyPI package targets Chimera users to steal AWS tokens, CI/CD secrets

Software development

Checkmarx Surfaces Malicious Effort to Compromise Software Supply Chains - DevOps.com

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

fromCSO Online

Information security

Malicious PyPI package targets Chimera users to steal AWS tokens, CI/CD secrets

Checkmarx Surfaces Malicious Effort to Compromise Software Supply Chains - DevOps.com

New malware targets application developers through typo-squatting, aiming to compromise software supply chains by providing persistent access and data exfiltration.

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

more#cybersecurity

JFrog Extends Alliance With NVIDIA to Secure AI Software Supply Chain - DevOps.com

JFrog and NVIDIA have expanded integrations to include the Enterprise AI Factory, enabling the management of AI applications through JFrog's Software Supply Chain Platform.

Artificial intelligence

DevOps

fromInfoQ

Docker Introduces Hardened Images to Strengthen Container Security

Docker's Hardened Images significantly enhance container security by reducing attack surfaces and minimizing vulnerabilities.

DevOps