Tag: package management
3 articles
GitHub Fortifies npm with Package Firewall to Thwart Malicious Installs
GitHub is stepping up its security game with a new package firewall for npm, blocking suspicious packages from being installed and protecting against malware attacks. This innovative firewall acts as a gatekeeper, inspecting metadata requests and package downloads to keep your systems safe.
AI Coding Tools Expose Open Source to Supply Chain Attacks
New research reveals a shocking vulnerability in AI coding tools: many suggested package names don't exist or point to outdated or compromised packages, leaving open-source projects open to supply chain attacks. This alarming gap in code-generation models highlights a pressing need for better safeguards.
Miasma Worm Spreads as Open-Source Toolkit Compromises GitHub Repos
A newly discovered open-source toolkit, known as Miasma Worm, is wreaking havoc on GitHub repositories, allowing attackers to execute a range of malicious activities via stolen credentials. This powerful supply chain attack toolkit can compromise multiple platforms, including PyPI, npm, and RubyGems, and even spread through AI coding tools and SSH-based lateral movement.