Supply chain

The packages were installed more than 1,700 times each prior to their removal from the repository.

This week, in the Application Security News, we dismiss magical thinking and discuss what generative AI will actually be able to do for us. We also discuss whether Secure by Design's goals are practical or not. OSC&R releases a report on software supply chain that should be interesting, though neither of us had time to read it yet. Also, Wat...

The U.S. Commerce Department has been urged by Sen. Ron Wyden, D-Ore., to bolster the already robust proposed U.S. tech rules that would prevent the utilization of the country's surveillance tools in repressive countries amid concerns of potential gaps that could be exploited by such nations.

Such an intrusion has prompted automated delivery of the malicious lottie-player NPM package versions among users who obtained the library through third-party content delivery networks.

The collaboration offers enterprises a scalable solution that integrates automated public key infrastructure and certificate management to secure continuous integration and continuous delivery pipelines without slowing developer workflows.

Most downloaded among the malicious packages was "blockscan-api," which is a backdoored copy of etherscan-api, followed by "passport-js," which is a backdoored passport copy, and the backdoored bcryptjs copy dubbed "bcrypts-js," an analysis from the Datadog Security Research team showed.

Third-party vendors responsible for 90% of multiple breaches in sector.

Five reasons why supply chain attacks continue – and three tips for how to respond.