dependency-track

OWASP Dependency-Track Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials SBO...

Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...

trust-software-supply-chain-poc

Trusted Software Supply Chain — Proof of Concept This proof-...

CloudPirates.io helm-charts software supply chain issue vulnerability

Versions of CloudPirates.io Helm Charts prior to 271d415 contain a software supply chain vulnerability. This vulnerability arises because the pullrequesttarget workflow utilizes github.event.pullrequest.head.sha or head.ref to retrieve forked code, allowing code controlled by attackers to access...

Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain

Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the Shai-Hulud worm and the Axios compromise demonstrate that a single malicious package can have wide reaching and devastating impacts overnight. These...

Argo Project Argo CD Software Supply Chain Vulnerabilities

The Argo Project’s Argo CD versions from 2.1.0 to 3.3.15, 3.4.0-rc1 to 3.4.10, 3.5.0-rc1 to 3.5.4, and 3.6.0-rc1 to 3.6.0-rc2 contain software supply chain vulnerability issues. This vulnerability arises when --enable-helm is enabled for kustomize builds, allowing helmGlobals.configHome to point ...

Apple Xcode Software Supply Chain Vulnerabilities

Versions of Apple Xcode prior to Xcode 27 contained vulnerabilities related to the software supply chain. These vulnerabilities stemmed from the failure to perform library validation on affected binary files, which could allow malicious applications to escape the sandbox...

Python Packaging Authority virtualenv software supply chain vulnerability

The Python Packaging Authority identifies a vulnerability in virtualenv versions prior to 21.14.9 within the software supply chain. This vulnerability arises when PipInvoke.getpipinstallcmd calls getwheeldownload=False during processing of --seeder pip --download, allowing pip to query the index ...

Can SOLARBURST Go Silicon? A Systematic Analysis on Software Supply Chain Attacks for VLSI Design Flows

An attacker targeting the software supply chain SWSC of VLSI tools can fully subvert the VLSI design pipeline through purely software level compromises. However, cur- rent literature on both SWSC and VLSI hardware security has not explored how software can be used to subvert the security of the...

Ivanti Connect Secure software supply chain issue vulnerabilities

The Ivanti Connect Secure version 22.8R2.4 has a software supply chain vulnerability. This vulnerability stems from the improper handling of trust in DSCache configuration data by the dsinvoked broker, which may lead to permission escalation to root access...

EnergizeLab AI Station software supply chain vulnerability issues

EnergizeLab AI Station has a software supply chain vulnerability. This vulnerability stems from downloading firmware updates via plaintext HTTP, without verifying their integrity and authenticity. This could allow attackers to replace malicious updates by intercepting or modifying traffic...

JetBrains Junie CLI software supply chain issue vulnerabilities

Versions of JetBrains Junie CLI prior to version 26.8.3 have vulnerabilities related to the software supply chain. These vulnerabilities stem from misconfigured MCP servers in untrusted projects, which may lead to code execution...

The Secure Software Factory: A Reference Architecture

The Secure Software Factory: A Reference Architecture is a 26-page whitepaper outlining a security framework for AI-driven software development environments. It describes how organizations can safely deploy autonomous coding agents by enforcing four security boundaries: sandbox isolation, network...

tributary

Tributary A software supply chain analyzer that tells you w...

Roman Perepelitsa Powerlevel10k – Vulnerabilities in the software supply chain

Roman Perepelitsa’s Powerlevel10k 1.20.0 and earlier versions have a vulnerability related to the software supply chain. This vulnerability arises from the gitstatus/install script disabling TLS certificate verification and skipping integrity checks. Cyber attackers can intercept requests for the...

How Financial Services Companies Can Modernize Their Software Supply Chain

Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices out the regression testing. Somebody else...

The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches

Key Takeaways Malicious packages can steal cloud credentials during installation, before applications run. Stolen credentials turn developer workstations and CI/CD pipelines into gateways to cloud resources. Restrict installation scripts, minimize credential privileges, protect metadata access, a...

Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains

This paper proposes a blockchain-backed agentic security framework designed to safeguard the complete software development lifecycle SDLC while also securing the agentic AI components responsible for monitoring it. The framework coordinates a set of specialised security agents, covering source...

Measuring the Security of the Evolving Software Supply Chain: A Research Agenda

Software supply chain security has become increasingly critical due to the widespread reliance on third-party dependencies and the growing attack surface of modern software ecosystems. However, existing quantitative, measurement-based analysis and vulnerability management approaches remain largel...

Malicious code in @yane88/listary-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd784784bedda93c768e67f6604062febe7761cb1ff3b1fb2178ad075aef10d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...