dependencies
Fake npm Packages Found in GitHub Repository
Security researchers discovered four vulnerable npm packages uploaded to GitHub that were capable of collecting the user’s IP address, geolocation and device hardware data. Not all attacks have a high-visibility profile. Some ...
Using Components with Known Vulnerabilities
When an organization has a breach, you would like to imagine that the attacker crafted a new exploit, leveraging a zero-day vulnerability that no one has any protection against. However, It is ...
PyPi ‘Cheese Shop’ Malware Illustrates Software Supply Chain Risk Vector
Recent malware installed in PyPI underscores the need for code verification at the code repository level to defend the software supply chain ...
