Featured Article
Introducing our 9th annual State of the Software Supply Chain report
2 New RubyGems laced with cryptocurrency-stealing malware taken down
5 minute read time
RubyGems removed 2 gems from its repo that contained malicious code. When run, it infected Windows machines and replaced any cryptocurrency wallet address it found on the user’s clipboard with the
Read More...
Nexus Intelligence Insights: Protect Your Bitcoin from 700+ Malicious RubyGems with sonatype-2020-0196
3 minute read time
Crafty attackers take advantage of the open source software supply chain through typographical errors. Not even the most sophisticated devs are immune.
Read More...
How Do Application-Level Package Managers Work?
7 minute read time
Managing dependencies is a complex task. As Sam Boyer explains, “It’s not the algorithmic side that makes [application-level package managers] hard.”
Read More...
What is a Package Dependency Manager?
4 minute read time
Terms like package manager, dependency management, repository, and repository manager are used in software development. Are we speaking a common language?
Read More...
Anatomy of the RubyGems ‘rest-client’ Hack, and Getting Creative About Open Source Security
3 minute read time
Last month, the RubyGems strong_password component was breached and injected with malicious code. This is only the latest example of bad actors attacking developers at the source.
Read More...
Corrupting the Software Supply Chain: Lessons From the Bootstrap-sass Hack
2 minute read time
The boldness of bad actors is escalating in the world of open source software. From the event-stream / NPM incident in November of 2018, to the recent bootstrap-sass / Ruby Gems hack, bad actors are
Read More...
Nexus Intelligence Insights: CVE-2014-3483 - SQL Injection in PostgreSQL adapter for Active Record against 'range' data type
3 minute read time
In this month's Nexus Intelligence Insights we discuss an older component that is used by millions of developers. Say hello to CVE-2014-3483, a SQL injection vulnerability.
Read More...
Nexus Repository Rising: Say Hello to the New Pro
3 minute read time
Upgrade to Nexus Repository Pro 3, now with active-active high availability. Build the best software using precise component intelligence.
Read More...
Nexus Reaches 50,000
5 minute read time
Active Nexus instances have grown 100% within the past 18 months. Just awesome. And, YOU, our user community made it happen. As of today, we surpassed the milestone of 50,000 active Nexus installs!