#software-supply-chain

#software-supply-chain

A widely used Node.js utility fast-glob appears maintained solely by a Yandex employee based in Russia, creating significant supply-chain security risk.

A Russia-based Yandex employee is sole maintainer of fast-glob, a widely used open-source package embedded in Department of Defense software, posing supply-chain risk.

Software teams now shoulder the entire software supply chain, facing unsustainable complexity, security and compliance burdens, and tool sprawl that increase cognitive load and risk.

OSS Rebuild enhances the security of open-source package ecosystems to prevent software supply chain attacks.

North Korean threat actors are deploying malicious npm packages as part of ongoing software supply chain attacks against the open-source ecosystem.

Artifact management has shifted to a strategic priority, focusing on security vulnerabilities in complex software environments.

Docker's Hardened Images significantly enhance container security by reducing attack surfaces and minimizing vulnerabilities.

Veracode enhances its risk management tool to strengthen DevSecOps capabilities and improve vulnerability identification in Kubernetes environments.