#open-source-security tag

2 days ago

Socket will block it with free malicious package firewall

Socket released Socket Firewall Free, a free CLI that blocks malicious dependencies at install time across npm, yarn, pnpm, pip, uv, and cargo.

4 days ago

Google's dev registration plan 'will end the F-Droid project

"The F-Droid project cannot require that developers register their apps through Google, but at the same time, we cannot 'take over' the application identifiers for the open-source apps we distribute, as that would effectively seize exclusive distribution rights to those applications," he said. "If it were to be put into effect, the developer registration decree will end the F-Droid project and other free/open source app distribution sources as we know them today," said Prud'hommeaux.

Tech industry

#software-supply-chain

fromInfoWorld

1 week ago

Information security

NPM attacks and the security of software supply chains

fromSecuritymagazine

Information security

The Top Threats Undermining the Security of Software Supply Chains

Information security

Nx NPM packages poisoned in AI-assisted supply chain attack

fromNextgov.com

Information security

Report: Russia-based Yandex employee oversees open-source software approved for DOD use

fromInfoWorld

1 week ago

Information security

NPM attacks and the security of software supply chains

fromSecuritymagazine

Information security

The Top Threats Undermining the Security of Software Supply Chains

Information security

Nx NPM packages poisoned in AI-assisted supply chain attack

fromNextgov.com

more#software-supply-chain

Information security

Report: Russia-based Yandex employee oversees open-source software approved for DOD use

Information security

fromCyberScoop

fromElectronic Frontier Foundation

The npm incident frightened everyone, but ended up being nothing to fret about

A social-engineering compromise of an npm maintainer briefly poisoned 18 popular packages, but quick detection and response limited the supply-chain attack’s impact and damage.

Privacy technologies

Rayhunter: What We Have Found So Far

Rayhunter detects cell-site simulators on mobile hotspots and community deployments have found CSS elsewhere but not evidence of CSS spying on US protests so far.

Information security

fromInfoQ