Featured Article
New Design, New Features: Maven Central Improvements for Developers
Going Online With the OWASP Vulnerability Management Guide Working Group
6 minute read time
The OWASP Vulnerability Management Guide (OVMG) project seeks to simplify vulnerability management into repeatable and scalable cycles.
Read More...
Wicked Good Development Episode 25: The Struggle With Open Source Licensing
25 minute read time
Filipp Kofman and Adam Such talk best practices for handling open source licensing and how beneficial it can be for managing dependencies.
Read More...
Intro to Malware Analysis: Analyzing Python Malware
11 minute read time
Understanding malware analysis and the process of researching security vulnerabilities is the first step toward implementing best practices.
Read More...
Malware Monthly - December 2022
10 minute read time
Sonatype's Malware Monthly brings you the latest information on malicious and suspicious packages discovered in software registries.
Read More...
Best Practices in Dependency Management: Cooking a Meal of Gourmet Code
5 minute read time
Close to 85% of every application is open source software. Better understanding your software supply chain starts with understanding dependency management.
Read More...
PyTorch Namespace (Dependency) Confusion Attack
4 minute read time
During the 2022 holiday season, a dependency confusion attack targeted PyTorch. Here's what users of PyTorch-NightlyBuild need to know.
Read More...
SCA and SAST: What Do They Do and How Can They Help Developers Like You?
5 minute read time
SCA and SAST tools help DevSecOps teams and application developers work together to identify vulnerabilities and improve security.
Read More...
PGP vs. sigstore: A Recap of the Match at Maven Central
7 minute read time
We put code-signing tools PGP and sigstore in a head-to-head match with Maven Central users to find a winner. The results may surprise you.
Read More...
Caroling Through the Season: The Sounds of the 4shells
8 minute read time
As 2022 wraps up, we wanted to take a moment not only to reflect on Log4j but also on the other two “4shell” vulnerabilities that were disclosed.
Read More...