Sonatype Security Research Team

Sonatype's Security Research Team is comprised 65 world class professionals with 500+ years of experience. The Team is focused on bringing real-time, in-depth intelligence and actionable information about open source and third party vulnerabilities to Sonatype customers.

READ MORE

CursedGrabber strikes again: Sonatype spots new malware campaign against software supply chains

3 minute read time

Sonatype has determined those behind the CursedGrabber Discord malware family, have published a new malware campaign against software supply chains
Read More...
software supply chain attack on Java developer community thwarted
READ MORE

Sonatype stops software supply chain attack aimed at the Java developer community

9 minute read time

Sonatype removed 3 malicious open-source Java components from Maven Central targeting popular software releases, stopping a software supply chain attack.
Read More...
The return of Validation Bypass (CVE-2019-19507) in `jpv`
READ MORE

CVE-2020-17479: The return of Validation Bypass (CVE-2019-19507) in `jpv`

3 minute read time

While updating our data for CVE-2020-17479 in JPV, an open-source JSON schema validator, we discovered that the vulnerability could still be exploited with the.
Read More...