trustlock

trustlock Git 네이티브 의존성 승인 컨트롤러입니다. 모든 의존성 변경 시 신뢰 신호를 평가합니다. 작동 방식 trustlock은 Git pre-commit 훅권고 모드과 CI 검사강제 모드로 실행됩니다: 권고 pre-commit: 위반 시 경고, 종료 코드 0, 모든 패키지가 승인되면 신뢰 기준선을 업데이트합니다. 강제 --enforce: 위반 시 차단, 종료 코드 1, 기준선을 업데이트하지 않습니다. 패키지별 평가 신뢰 신호: 쿨다운Cooldown — 레지스트리에 게시된 이후 경과 시간 출처Provenance —...

Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting 32 maliciously modified packages across more than 90 versions under the @redhat-cloud-services npm scope. The...

Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

In this article 1. Attack chain overview 1. Technical analysis 2. How GitHub took action to prevent further harm 2. Mitigation and protection guidance 1. Microsoft Defender XDR Detections 2. Microsoft Defender XDR Threat analytics 3. Advanced hunting 4. Indicators of Compromise IOC 3. References ...

Exploit for Embedded Malicious Code in Tanstack Tanstack\/Arktype-Adapter

TanStack Supply Chain Compromise - IOC Checker bash curl -...

Google Expands Its Bug Bounty Program to Tackle Artificial Intelligence Threats

Google has announced that it's expanding its Vulnerability Rewards Program VRP to compensate researchers for finding attack scenarios tailored to generative artificial intelligence AI systems in an effort to bolster AI safety and security. "Generative AI raises new and different concerns than...