A malicious 'Distutil' PyPI package, active Spring4Shell exploitation by attackers deploying cryptominers, An open source tool that enabled users to add Google Play to PCs, but secretly installed
Read More...
Fixing a Vulnerability? Make Sure Your GitHub Isn't Showing Too Much
5 minute read time
February's $326 million crypto hack at Wormhole and this month's findings by Sonatype shed light on the importance of secrets management for open source developers.
Read More...
Gitpaste-12: A dozen exploits that silently lived on GitHub, attacked Linux servers
5 minute read time
Gitpaste-12, a worming botnet, is extremely versatile in its advanced capabilities as it leverages trustworthy sites like GitHub and Pastebin to host itself.
Read More...
Find and Fix Vulnerabilities in Seconds using GitHub PR Reviews with Line Comments
2 minute read time
Pull Request line comments highlight code that introduces a policy violation. This gives developers the information needed to remediate security risks.
Read More...
DevSecOps Delivered: Automated GitHub Pull Requests
1 minute read time
This episode is a quick demonstration of GitHub automated pull requests in Nexus Lifecycle, and why you would want to use them.
Read More...
Developers Gain Contextual Feedback with Automated Pull Request Commenting
2 minute read time
Pull request comments provide contextual information about the individual branch a developer is working on, and changes that they may have introduced.
Read More...
Microsoft Acquires npm: A Healthy Move for Critical Public Infrastructure
3 minute read time
Today, news broke that GitHub and its parent company Microsoft, acquired npm and its public repository of open source JavaScript packages.
Read More...
How to Use Sonatype OSS Index to Identify Security Vulnerabilities
8 minute read time
OSS Index enables developers to quickly find vulnerabilities in any library with an easy-to-use search feature. Learn more, and how to access the plugins.
Read More...
Sonatype has long been the world’s premier provider of open source health and hygiene data. Now, it's bringing that data to GitHub with six new Nexus integrations.
Read More...