Researchers found insecure bootstrap scripts in legacy Python packages that could allow attackers to exploit a domain takeover. The scripts fetch an outdated installation package from a now-available domain, which poses a risk of executing malicious code. Some affected packages have removed the scripts, but others, like slapos.core, still include them.

Socket has launched a Threat Intel page that tracks ongoing supply chain attack campaigns affecting open-source packages. The new feature helps teams quickly determine if they are impacted by these coordinated attacks and provides context for affected packages.

This article provides a comprehensive analysis of the Shai Hulud 2.0 supply chain attack, detailing the compromised code libraries and the extent of the breaches. It also lists tools and methods for detecting and mitigating the impact of these attacks, emphasizing the importance of version pinning and runtime monitoring.

The article discusses six newly discovered JavaScript zero-day vulnerabilities that could allow attackers to exploit package managers and execute malicious code. Experts warn that these flaws could enable large-scale supply chain attacks, especially if attackers gain access to package maintainers' credentials. The need for stronger security measures in software supply chains is emphasized.

Security flaws in npm's defenses against supply-chain attacks allow hackers to bypass protections through Git dependencies. Although other package managers have patched their vulnerabilities, npm rejected a vulnerability report from Koi Security, claiming users must vet package content themselves.

The article discusses a recent supply chain attack targeting the npm ecosystem, which compromised the Shai Hulud package. It highlights the implications of such attacks on software security, emphasizing the need for vigilance in managing dependencies and securing the software supply chain.

The article discusses a major npm supply chain hack affecting the eslint-config-prettier package, highlighting the risks associated with third-party dependencies in software development. It emphasizes the importance of securing package management ecosystems to prevent similar vulnerabilities in the future.

A recent supply chain attack has compromised several npm packages, allowing the distribution of backdoor malware. This incident highlights vulnerabilities in the software supply chain, emphasizing the need for enhanced security measures in package management systems.

A report has revealed that 40 npm packages have been compromised as part of a supply chain attack, exposing vulnerabilities that could potentially affect thousands of projects. The malicious packages were designed to steal sensitive data and create backdoors for attackers, highlighting the ongoing risks in open-source software ecosystems. Developers are urged to review their dependencies and ensure they are not using affected packages.

GitHub outlines its strategy to enhance the security of the npm supply chain, focusing on improving the safety of open-source software dependencies. The plan includes implementing better verification processes and tools to mitigate risks associated with malicious packages and vulnerabilities.

Developer environments are increasingly vulnerable to security risks due to the rise of agentic coding assistants, which interact with systems in complex ways that can introduce malicious code and escalate privileges. The lack of built-in security features in Model Context Protocol servers and rules files exacerbates these risks, leading to potential supply chain attacks. To mitigate these threats, organizations should implement traditional best practices such as sandboxing, supply chain scrutiny, and enhanced monitoring of coding assistant workflows.