Tag: package management
2 articles
AI Coding Tools Expose Open Source to Supply Chain Attacks
New research reveals a shocking vulnerability in AI coding tools: many suggested package names don't exist or point to outdated or compromised packages, leaving open-source projects open to supply chain attacks. This alarming gap in code-generation models highlights a pressing need for better safeguards.
Miasma Worm Spreads as Open-Source Toolkit Compromises GitHub Repos
A newly discovered open-source toolkit, known as Miasma Worm, is wreaking havoc on GitHub repositories, allowing attackers to execute a range of malicious activities via stolen credentials. This powerful supply chain attack toolkit can compromise multiple platforms, including PyPI, npm, and RubyGems, and even spread through AI coding tools and SSH-based lateral movement.