Open Source

Malicious packages in npm evade dependency detection through invisible URL links: Report

Researchers outline how the PhantomRaven campaign exploits hole in npm to enable software supply chain attacks.

Warning: Hackers have inserted credential-stealing code into some npm libraries

‘This is a new frontier’ of malware in open source repositories, says one expert.

Researchers uncover RCE attack chains in popular enterprise credential vaults

Open-source credential management systems HashiCorp Vault and CyberArk Conjur had flaws enabled remote code execution among other attacks.

Supply chain attack compromises npm packages to spread backdoor malware

Phishing attacks on package maintainer accounts led to infected JavaScript type testing utilities.

Get a Jump on Reducing Your Open Source Software Security Risks

GitHub secrets: Deleted files still pose risks

By leveraging Git’s version control features, one can retrieve deleted files and the sensitive content within.

Thousands of open source projects at risk from hack of GitHub Actions tool

Researchers say compromised tool in the GitHub CI/CD environment stole credentials; infosec leaders need to act immediately.