The history of Maven Central and Sonatype: A journey from past to present
11 minute read time
Explore the evolution of Maven Central, highlighting its crucial role in the Java ecosystem and software development overall and its connection to Sonatype
Read More...
SAST vs. DAST: Enhancing application security
7 minute read time
Explore advantages and limits of static application security testing SAST and dynamic application security testing DAST in application security
Read More...
npm packages caught exfiltrating Kubernetes config, SSH keys
4 minute read time
Sonatype tracks an ongoing campaign that uses npm packages to retrieve and exfiltrate Kubernetes configuration and SSH keys to an external server
Read More...
New npm PoC packages target PayPal Zettle, Airbnb developers
4 minute read time
Sonatype identified npm packages that exploit dependency confusion, named after internal dependencies purportedly used by PayPal Zettle and Airbnb
Read More...
A guide for open source software (OSS) security
6 minute read time
Evaluate open source software (OSS) security to ensure safe usage of software components in software development life cycles and software supply chains
Read More...
Malicious PyPI package ‘VMConnect’ imitates VMware vSphere connector module
3 minute read time
A malicious PyPI package ‘VMConnect’ designed to resemble VMware vSphere Connector Module was caught by Sonatype’s automated malware detection systems
Read More...
Getting started with the Secure Software Development Framework (SSDF)
6 minute read time
Discover how to get started with the Secure Software Development Framework (SSDF), what it contains, and why should you leverage it
Read More...
“Quoi...? feur” from meme to malware – PyPI package targets Windows with ‘NullRAT’ info-stealer
3 minute read time
A malicious PyPI package called ‘feur’ was caught by Sonatype’s automated malware detection systems
Read More...
A closer look: Differentiating software vulnerabilities and malware
7 minute read time
Vulnerabilities and malware in open source software pose significant threats to the security and integrity of your software supply chain
Read More...