This Week in Malware - 135 packages target npm and PyPI registries
3 minute read time
This week in malware, we discovered and analyzed 135 packages flagged as malicious, suspicious, or dependency confusion attacks in npm and PyPI registries.
Read More...
Despite what some vendors say, please don't ignore Log4j
5 minute read time
Ignoring Log4j and recommending that high-risk open source vulnerabilities be left in application code isn't just irresponsible, it's dangerous.
Read More...
This Week in Malware - Over five dozen more packages discovered
2 minute read time
This week in malware we discovered and analyzed over five dozen packages flagged as malicious, suspicious, or dependency confusion attacks.
Read More...
This Week in Malware - Almost 100 packages
2 minute read time
This week in malware Sonatype discovered and analyzed over seven dozen packages flagged as malicious, suspicious, or dependency confusion attacks.
Read More...
Rule over your dependencies and scan at your own open source risk
5 minute read time
A good way to make sure that your organization's vulnerabilities don't go unnoticed is conducting regular scans of open source used in your environments.
Read More...
This Week in Malware—Ongoing Dependency Confusion
4 minute read time
This week in malware, Sonatype's automated malware detection systems have spotted over four dozen dependency confusion candidates.
Read More...
This Week in Malware - A PyPI phishing follow-up plus 120 packages
4 minute read time
This week Sonatype discovered and analyzed 120 packages flagged as malicious, suspicious, or dependency confusion attacks.
Read More...
This Week in Malware - 450 packages and a phishing campaign against PyPI maintainers
6 minute read time
This week Sonatype discovered and analyzed 450 packages flagged as malicious, suspicious, or dependency confusion attacks.
Read More...
This Week in Malware — Cryptominers flood npm, PyPI, and more dependency confusion
2 minute read time
This week Sonatype discovered 200+ npm and PyPI packages that are cryptominers, with additional packages comprising dependency confusion PoCs.
Read More...