supply chain

Last week, the Internet dodged a major nation-state attack that would have had catastrophic cybersecurity repercussions worldwide. It’s a catastrophe that didn’t happen, so it won’t get much attention—but it should. There’s ...

Forking hell: Scrotebots clone thousands of projects, injecting malware millions of times ...

Portland, OR – February 27, 2024 – Eclypsium, the leader in digital supply chain security for enterprise hardware, firmware and software infrastructure, and Second Front Systems (2F), whose mission is to accelerate ...

Software developers are being targeted with malicious packages in npm and PyPI as threat groups launch software supply-chain attacks ...

Phylum found an increase in the discovery of malicious packages targeting the software supply chains of specific organizations ...

By Artur Cygan Creating reproducible builds for SGX enclaves used in privacy-oriented deployments is a difficult task that lacks a convenient and robust solution. We propose using Nix to achieve reproducible and ...

At Trail of Bits, we pride ourselves on making our best tools open source, such as Slither, PolyTracker, and RPC Investigator. But while this post is about open source, it’s not about ...

”Supply chain attack” encompasses many different forms of attacks and exploits Yet another type was recently uncovered – malicious behavior in properly signed installers While this particular case was not Java specific, ...

By Spencer Michaels, William Woodruff, Jeff Braswell, and Cliff Smith Trail of Bits cares about internet freedom, and one of our most valued partners in pursuit of that goal is the Open ...

SBOMs aren’t the only bills of materials that are necessary for the protection of your tech stack. XBOMs are growing in importance ...