Sonatype Guide

Image with text "281 malicious package versions, Miasma Returns"

New Shai-Hulud Miasma Wave Hits Hundreds of npm Packages

| | malicious code npm, Malware, Malware Analysis, npm, Security Research, Sonatype Guide, Supply Chain Attacks
TL;DR Sonatype Security Research is tracking a new Shai-Hulud Miasma wave with 281 malicious npm package versions that move beyond obvious preinstall and postinstall scripts in package.json. This variant abuses binding.gyp to ...
2024 Sonatype Blog
Image with text "Lazarus Group, Trust Abuse on npm" at center and a label of "breaking news" in the upper right-hand corner.

Lazarus Group’s Latest: Brandjacking Campaign on npm

| | malicious code npm, Malware, Malware Analysis, npm, Security Research, Sonatype Guide, Supply Chain Attacks
TL;DR Sonatype Security Research is tracking a Lazarus Group npm campaign using dozens of malicious packages to abuse developer trust and deliver follow-on payloads. The campaign goes beyond typosquatting, relying on brandjacking ...
2024 Sonatype Blog
5 Steps to Turn Your RMF Backlog Into a Continuous ATO: The CSRMC Migration Playbook

5 Steps to Turn Your RMF Backlog Into a Continuous ATO: The CSRMC Migration Playbook

| | devops in government, DevSecOps, Federal, framework, government, risk management, Sonatype Guide, Sonatype Lifecycle
Let's be honest about the legacy Risk Management Framework (RMF): for the last decade, achieving an ATO has been less about actual cybersecurity and more about creative writing. We built three-year "snapshot" ...
2024 Sonatype Blog
Red Hat Cloud Services npm Packages Hijacked

Red Hat Cloud Services npm Packages Hijacked

| | malicious code npm, Malware, npm, red hat, Security Research, Sonatype Guide, Supply Chain Attacks
A new wave of malicious npm activity has been reported involving multiple packages in the legitimate @redhat-cloud-services namespace ...
2024 Sonatype Blog
Inside a 176-Package npm Campaign Built to Beat Your Internal Dependencies

Inside a 176-Package npm Campaign Built to Beat Your Internal Dependencies

| | Malware, Malware Analysis, Sonatype Guide, Vulnerabilities
The latest malware campaign uncovered by Sonatype researchers involved 176 malicious npm packages, many published with the exact same version number: 99.99.99 ...
2024 Sonatype Blog
Hijacked npm Package Attempts to Deliver PolinRider-Linked RAT

Hijacked npm Package Attempts to Deliver PolinRider-Linked RAT

| | embedded malicious code, malicious code npm, npm, open source risk, open-source malware, Sonatype Guide, Threat
Attackers do not need to wait for a CVE when they can publish directly into the build ...
2024 Sonatype Blog
Building Trusted AI Development With Kiro and Sonatype Guide

Building Trusted AI Development With Kiro and Sonatype Guide

| | AI, Artificial Intelligence, aws, Model Context Protocol, open source, Sonatype Guide, sonatype intelligence
AI-powered development tools accelerate the production of software. But they also introduce a familiar challenge: how do you ensure that what's generated is secure, compliant, and trustworthy? ...
2024 Sonatype Blog
Image with a skull icon alongside text "CanisterSprawl: Self-propagating malware on npm"

Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

| | Malware, Malware Analysis, npm, open-source malware, PyPI, Sonatype Guide, Supply Chain Attacks
TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised ...
2024 Sonatype Blog

Axios Compromise on npm Introduces Hidden Malicious Package

| | malicious code npm, Malware, Malware Analysis, npm, open-source malware, Security Research, Sonatype Guide, Sonatype Research
A newly discovered software supply chain attack targeting the npm ecosystem briefly compromised one of the most widely used JavaScript libraries in the world ...
2024 Sonatype Blog
Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer

Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer

| | AI, LLMs, Malware, Malware Analysis, PyPI, python, Security Research, Sonatype Guide, Sonatype Research
This morning, the widely used Python package litellm, a popular abstraction layer for interacting with large language models (LLMs), was compromised and two malicious versions released (1.82.7 and 1.82.8) ...
2024 Sonatype Blog
Load more