#NPM package 'is' with 2.8M weekly
downloads was compromised and infected developers with malware:
#AppSec
#SoftwareSupplyChainSecurity

https://www.bleepingcomputer.com/news/security/npm-package-is-with-28m-weekly-downloads-infected-devs-with-malware/

#NPM: New Supply Chain #Malware Hits NPM and #PyPI Package Ecosystems. #ReactNative-Aria & #GlueStack packages with cumulative 1mln+ weekly downloads backdoored overnight - check your dependencies!
#SoftwareSupplyChainSecurity

https://thehackernews.com/2025/06/new-supply-chain-malware-operation-hits.html

#NPM: Two malicious packages were discovered on npm (#NodeJS package manager) that covertly patch legitimate, locally installed packages to inject a persistent reverse shell backdoor:
#SoftwareSupplyChainSecurity

https://www.bleepingcomputer.com/news/security/new-npm-attack-poisons-local-packages-with-backdoors/

#PyPI: 20 Malicious Python PyPI Packages Stole Cloud Tokens - Over 14,100 Downloads Before Removal:
#SoftwareSupplyChainSecurity

https://thehackernews.com/2025/03/malicious-pypi-packages-stole-cloud.html

#GitHub: Critical security incident involving the popular tj-actions/changed-files GitHub Action which contained credentials/secrets exfiltration malware! (CVE-2025-30066)
#SoftwareSupplyChainSecurity
#tjactions

https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

#Rspack: a popular alternative to webpack - a JavaScript bundler written in Rust - #npm package with 300,000+ downloads/week version 1.1.7 compromised with attackers injecting cryptocurrency mining malware:
#SoftwareSupplyChainSecurity

https://thehackernews.com/2024/12/rspack-npm-packages-compromised-with.html

#Solana JavaScript SDK was temporarily compromised yesterday in a supply chain attack, with the library backdoored with malicious code to steal cryptocurrency private keys and drain wallets:
#SoftwareSupplyChainSecurity

https://www.bleepingcomputer.com/news/security/solana-web3js-library-backdoored-to-steal-secret-private-keys/

#NPM: XMLRPC npm Library Turns Malicious, Steals Data, Deploys Crypto Miner:
#SoftwareSupplyChainSecurity

https://thehackernews.com/2024/11/xmlrpc-npm-library-turns-malicious.html
https://thehackernews.com/2024/11/xmlrpc-npm-library-turns-malicious.html

#PyPi: Malicious #Python Package 'fabrice' Typosquats Popular 'fabric' SSH Library, Silently Exfiltrates AWS Credentials from unsuspecting developers:
#SoftwareSupplyChainSecurity

https://socket.dev/blog/malicious-python-package-typosquats-fabric-ssh-library

It's a losing proposition to generate SBOMs just to land a federal contract or meet an industry requirement, without analyzing and acting on its data to improve software security. #SBOM #SoftwareSupplyChainSecurity #SecurityTools #SCA #SDLC #SSCS
https://tinyurl.com/yncw4688

#OpenJS Foundation Targeted in Potential JavaScript Project Takeover Attempt in a manner similar to the recent XZ incident:
#SoftwareSupplyChainSecurity

https://thehackernews.com/2024/04/openjs-foundation-targeted-in-potential.html

https://thehackernews.com/2024/04/openjs-foundation-targeted-in-potential.html

Any experienced C developers among my followers? #BoostsWelcome.

Expat, arguably the world's most popular #XML parser, is understaffed and without funding. As #xz has shown, situations like this are dangerous.

Last month, maintainer Sebastian Pipping put up a plea for help at https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes

(I would help myself, but my C skills barely surpass "Hello, World".)

Found via @timbray - https://cosocial.ca/@timbray/112203547801373427

#libexpat
#SoftwareSupplyChainSecurity #OpenSource #OpenSourceMaintainer
#C

Anyone have a copy of the comporised xz source code for analysis purposes? #security #SoftwareSupplyChainSecurity #softwareengineering

#Python: Over 170K Users Affected by Attack Using Fake Python Infrastructure with "successful exploitation of multiple victims" according to the Checkmarx Research Team blog post:

#SoftwareSupplyChainSecurity
#colorama

https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure/
https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure/

#NPM: Over 800 npm Packages Found with Discrepancies, 18 Exploitable to 'Manifest Confusion' software supply chain attacks:
#SoftwareSupplyChainSecurity

https://thehackernews.com/2024/03/over-800-npm-packages-found-with.html

https://thehackernews.com/2024/03/over-800-npm-packages-found-with.html

Up next in my SBOM Skills series: 99% of the news is not on the front page! What are you missing by not tracking your "Below the Fold" SBOMS?

How and why you should find and manage the containers, infrastructure and middleware pieces that most SBOMs are missing.

Read more here:
https://zebracatzebra.com/sbom-skills/the-importance-of-below-the-fold-sboms/ #oss #opensource #softwaresupplychainsecurity #sbom

What lessons can we learn from 20 years of managing invisible cut and pastes of Open Source code and how can we apply them to managing code generated by AI tools?
https://zebracatzebra.com/oss/what-20-years-of-stolen-snippets-teaches-about-managing-ai-generated-code/ #ai #sbom #softwaresupplychainsecurity #opensource