dependency-track

OWASP Dependency-Track Dependency-Trackは、組織がソフトウェアサプライチェーンにおけるリスクを特定し軽減することを可能にする、インテリジェントなコンポーネント分析プラットフォームです。Dependency-Trackは、ソフトウェア部品表（SBOM）の機能を活用するという、独自で非常に有益なアプローチを採用しています。 !Mastodonhttps://img.shields.io/badge/Mastodon-636...

Supply-Chain

ソフトウェアサプライチェーンセキュリティ ソフトウェアサプライチェーンセキュリティに関する包括的な3冊シリーズ。脅威、防御、ガバナンスをカバーします。このオープンソース原稿は、セキュリティ専門家、開発者、組織のリーダーに、現代のソフトウェア開発プラクティスを保護するための実践的なガイダンスを提供します。 本書シリーズ 書籍| タイトル| 章| 焦点 ---|---|---|--- ブック1| ソフトウェアサプライチェーンの理解| 1-10| 基礎と攻撃パターン ブック2| ソフトウェアサプライチェーンの保護| 11-22| 実践的な防御と実装 ブック3| ソフトウェアサプライチェーンの統...

How Financial Services Companies Can Modernize Their Software Supply Chain

Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices out the regression testing. Somebody else...

The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches

Key Takeaways Malicious packages can steal cloud credentials during installation, before applications run. Stolen credentials turn developer workstations and CI/CD pipelines into gateways to cloud resources. Restrict installation scripts, minimize credential privileges, protect metadata access, a...

Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains

This paper proposes a blockchain-backed agentic security framework designed to safeguard the complete software development lifecycle SDLC while also securing the agentic AI components responsible for monitoring it. The framework coordinates a set of specialised security agents, covering source...

Measuring the Security of the Evolving Software Supply Chain: A Research Agenda

Software supply chain security has become increasingly critical due to the widespread reliance on third-party dependencies and the growing attack surface of modern software ecosystems. However, existing quantitative, measurement-based analysis and vulnerability management approaches remain largel...

Malicious code in @yane88/term-reqable-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c0e2129fbf1e7a2da4c71b24bbd38abade289a0f9aa576bacefb53566046cc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @yane88/listary-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd784784bedda93c768e67f6604062febe7761cb1ff3b1fb2178ad075aef10d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

ATM Flaws Reveal Key Weaknesses in the Software Supply Chain

A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software. But the problems extend far beyond your local cash machine...

Malicious code in cloufcrxz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb997ba2e8af58bd0d35d6e2cfb2264b4ae0132e071fc5b0e3e58f3326e37a9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack9ai4f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad80debb4a4957755c5f2089e44a287a0c9019e769f550b12e6ec0d7eddc22a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack0y4arx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b0ee85099f27ca35f55b12120ad7980852aab16079399ddf94f3dec87c8deea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackoo3m1u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9409725a0c60e28d487058cfed06d57101ed7eb4fdf031e19ad43e72f2597d3c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackujfdgm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2410d34a77cd3d19e207d15edd8221ff5a49932ee4a6052fa30668b92e810b96 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack5vpco (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d7f6e539028bc60b1b035b1f56a075db641a49fb092fbf7f1ee859210925e99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack2cyinb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e160520778ca6e1c474aa74fb066efea18747c08d4efbafcc7ece8ae185f5b21 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack9ma2d (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19f56ed19a408b179769ab113af64880f60ddb0ad671a983ecaab4fd804c61a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desmos-graphing-l5t17nyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9ad99fa93d6470ff0e403af07ba26efa2a2c72dab859da20722eaa768d9d364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desmos-graphing-w7am2h4f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a587a6a9d79a435737148758d763bbb316e529fac1e72eca1d57764886a442f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-21753

HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment...