Malicious npm packages impersonate Alibaba tools to deliver a cross-platform RAT with command execution, persistence, and ...

Microsoft will limit new NuGet API keys to 30 days from August 17, 2026, as it strengthens software supply-chain security.

Dependency confusion is a supply chain issue that affects how package managers choose where to download a dependency from. If your build or developer tooling can see both a private package registry ...

Bloom Security emerges from stealth with a $20M seed led by Glilot Capital and Ten Eleven Ventures. The Tel Aviv startup argues that AI agents, MCP servers, and browser extensions have turned every ...

New findings connect the same Pyongyang-backed group to four compromises dating to 2025, revealing a larger operation than ...

HYDERABAD: Cyberattacks using malicious software packages have increased 75-fold over the past two years, with nearly half now masquerading as trusted software, ...

A DPRK-linked threat actor has been tied to four separate compromises of widely used JavaScript libraries since March 2025, ...

NetRise®, the software supply chain security company that exists to eliminate blind trust in software, today announced enhancements to NetRise Provenance®, bringing package trust enforcement into the ...

Almost every company can now produce a list of what’s inside its software. Almost none can prove the list is right. Related: ...

Veracode, the global leader in application risk management, today announced the launch of the Veracode Marketplace, a curated ecosystem that gives customers a single, trusted destination to discover, ...

The first connected home delivery ecosystem combining smart hardware, delivery intelligence and protection to help ...

After OpenAI's models broke into Hugging Face, Anthropic checked its own history and found three similar incidents ...