Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Top Software Supply Chain Security Vulnerabilities Explained

aikido.dev | blog | #supply-chain | #open-source | #npm | #ci-cd | #typosquatting | #sbom

Summary

Breaks down nine supply chain vulnerabilities from typosquatting to CI/CD compromise, citing Sonatype's 700,000+ malicious packages and an npm breach that backdoored 18 widely-used libraries.
Published
Collected

original ↗

Related coverage

  1. From DEF CON Research to Automated Supply Chain Defense, finding npx confusion vulnerabilities with npxconfuse (lab.ctbb.show)
  2. Shai-Hulud Rises From the Dead after 111 days (aikido.dev)
  3. PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting (crowdstrike.com)
  4. Extending the Single Source of Truth to the Agentic Software Supply Chain (jfrog.com)
  5. Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign (wiz.io)
  6. The Overlooked Attack Surface: Securing Code Repositories, Pipelines, and Developer Infrastructure (wiz.io)

back