PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Supply chain attacks are exploiting our assumptions

blog.trailofbits.com | incident | #supply-chain | #pypi | #supply-chain-security | #typosquatting | #build-pipeline | #sbom | #trusted-publishing | #package-registry
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

From typosquatting to poisoned pipelines, supply chain attacks exploit implicit trust in package registries; tools like TypoGard, Zizmor, and PyPI Trusted Publishing make trust verifiable.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Trusted publishing: a new benchmark for packaging security
Trail of Bits partnered with PyPI on trusted publishing, an OIDC-based auth method that removes long-lived API tokens, cutting supply chain attack and credential leak risks in package releases.
blog · about.gitlab.com
Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting
GitLab researchers found five malicious PyPI packages, including typosquats of Flask, Requests, and NumPy, that deploy the Shai-Hulud worm via .pth files to steal CI/CD credentials.
blog · aikido.dev
What is Slopsquatting? The AI Package Hallucination Attack Already Happening
Slopsquatting is typosquatting's AI successor: attackers register package names LLMs hallucinate, waiting for developers to install them on the model's recommendation. It's already happening.
blog · aikido.dev
Introducing Aikido Package Health: a Better Way to Trust Your Dependencies
Aikido Package Health surfaces the true health of an open source package with a single score. It helps devs understand stability, maintenance quality, and supply-chain risk before installing a dependency.
blog · aikido.dev
Top Software Supply Chain Security Vulnerabilities Explained
Breaks down nine supply chain vulnerabilities from typosquatting to CI/CD compromise, citing Sonatype's 700,000+ malicious packages and an npm breach that backdoored 18 widely-used libraries.
blog · netspi.com
3 Software Supply Chain Risks in 2023
Software supply chain attacks in 2023 cluster into three categories: package manager attacks like dependency confusion and typosquatting, developer compromise, and breaches at large software vendors.
Back