Developers Need Two Things: The Nexus Platform and a Full Pot of Coffee
5 minute read time
Waiting too long to invest in security is too common. Sonatype's Nexus platform helps orgs protect themselves from known and unknown vulnerabilities.
Read More...
The Magic Behind Over 101,000 Malicious Packages Discovered and Blocked
3 minute read time
A look at how Sonatype software is protecting development teams and software with the industry-leading tools.
Read More...
Arming the Defender Force and Securing the Software Supply Chain: Helping Developers Implement CISA Best Practices - Part 1
4 minute read time
Sonatype's Nexus Platform helps give DevSecOps practitioners the tools they need to help secure the software supply chain against malicious cyber attacks.
Read More...
This Week in Malware—Killing Windows Defender With an npm Package
3 minute read time
This Week in Malware we discuss a malicious npm package that disables Windows Defender before dropping a trojan, and ongoing dependency confusion findings.
Read More...
npm Package Disables Windows Defender Before Dropping Trojan
4 minute read time
npm package 'flame-vali' makes multiple attempts to disable Windows Defender on the infected system before downloading a cryptominer.
Read More...
Malicious packages caught this week exfiltrate Amazon EC2, Windows SAM credentials, and launch malicious executables.
Read More...
This Week in Malware—Malicious Rust crate, 'colors' Typosquats
6 minute read time
From a malcious Rust typosquat found in the crates[.]io repository to ongoing typosquatting attacks on 'colors' library, the OSS security problem hasn't gone away just yet.
Read More...
This Week in Malware—Apache Kafka Typosquats, Shorthand Data Exfiltration
4 minute read time
This Week In Malware—May 6th edition: Apache Kafka typosquat, and a simple distraction technique.
Read More...
npm Package Downloads Another Package While Exfiltrating Your IP Address and Username
5 minute read time
On any given day we analyze hundreds of suspicious npm and PyPI packages, but this one stood out to us. An npm package that downloads another empty npm package?
Read More...