npm package disables Windows Defender before dropping Trojan
3 minute read time
npm package 'flame-vali' makes multiple attempts to disable Windows Defender on the infected system before downloading a cryptominer.
Read More...
How to manage your open source licenses in 2022
7 minute read time
Development teams are using openly licensed software in their process, and lots of it. To comply with the requirements, you need license management tools.
Read More...
Sonatype CTO shares thoughts following conversations, led by OpenSSF, where industry and government came together to discuss securing open source software.
Read More...
Take control of your InnerSource components with InnerSource insight
7 minute read time
InnerSource Insight, an industry-first capability, makes it easier and safer for developers to use components developed by others in their organization.
Read More...
npm package downloads another package while exfiltrating your IP address and username
4 minute read time
On any given day we analyze hundreds of suspicious npm and PyPI packages, but this one stood out to us. An npm package that downloads another empty npm package?
Read More...
Malicious npm 'colors' typosquats pack Discord malware
5 minute read time
Sonatype has caught newer typosquats of the popular 'colors' npm library that contain Discord info-stealing malware.
Read More...
This Week in Malware — npm backdoors, bugs, 'mystery placeholders'
6 minute read time
This Week in Malware we discuss malicious packages with backdoors and hidden Discord stealers, a serious npm bug that allowed for maintainer tampering, and.
Read More...
In a special edition of This Week in Malware, we change focus and look at protestware and the tale of a two-year-old Struts bug that's returned.
Read More...
VMware VSphere dependency confusion attempt caught by Sonatype
5 minute read time
Sonatype's automated malware detection bots flagged a suspicious dependency that has the same name as a real package used by VMware VSphere SDK developers.
Read More...