Sonatype Delivers Premium Open Source Controls to GitHub | Press Release

blog-logo Sonatype Blog

How Do Application-Level Package Managers Work?

By Ember DeBoer on January 23, 2020 repository manager
Managing dependencies is a complex task. As Sam Boyer explains, “It’s not the algorithmic side that makes [application-level package managers] hard.”
Read More...

What is a Package Dependency Manager?

By Ember DeBoer on January 22, 2020 Apache Maven
Terms like package manager, dependency management, repository, and repository manager are used in software development. Are we speaking a common language?
Read More...

Nexus Intelligence Insights: Sonatype-2020-0003 - npm malicious package 1337qq-js

By Elisa Velarde on January 15, 2020 vulnerabilities
In this month's Nexus Intelligence Insights, we cover Sonatype-2020-0003: npm malicious package 1337qq-js. Here's why it made noise but had no impact.
Read More...

Publishing Private NPM Packages to Nexus

By Erik Dietrich on June 12, 2019 How-To
From DRY principle, sharing code within an organization, and keeping code secure, there are many reasons you may want to publish private NPM packages to Nexus. Today, we show you the how.
Read More...

Corrupting the Software Supply Chain: Lessons from the Bootstrap-sass Hack

By Elisa Velarde on April 09, 2019 vulnerability
The boldness of bad actors is escalating in the world of open source software. From the event-stream / NPM incident in November of 2018, to the recent bootstrap-sass / Ruby Gems hack, bad actors are
Read More...

Open Source Software Is Under Attack; New Event-Stream Hack Is Latest Proof

By Brian Fox on November 27, 2018 vulnerabilities
Open source software is under attack, and the malicious attack on the popular npm event-stream 3 package, is just the latest proof.
Read More...

3 steps to deal with the aftermath of the highjacked eslint-scope package

By Ilkka Turunen on July 13, 2018 npm
Yesterday at noon BST a new github issue was opened in the popular eslint repository on github. Someone had highjacked this package which stole user's credentials. Here's how to react to the
Read More...

Open Sourcing npm in Nexus Repository Manager 3

By Joseph Stephens on April 02, 2018 npm
Open Sourcing npm in Nexus Repository Manager 3
Read More...

Using Nexus IQ Server with the webpack Plugin

By Ross Pokorny on December 15, 2017 npm
We realize that these challenges are not unique to our own development. For that reason, we released the webpack plugin to our FOSS community repo.
Read More...