608 matches found
npm Account Hijacking and the Rise of Supply Chain Attacks
npm Account Hijacking and the Rise of Supply Chain Attacks By Trellix Advanced Research Center · September 26, 2025 Contributed by John Fokker, Ilya Kolmanovich, Pavan Podila, Mo Cashman and Jeffrey Sman Key Takeaways Software Supply Chain Attacks are on the Rise: The "Shai-Hulud" worm targeting...
Investigating Security Implications of Automatically Generated Code on the Software Supply Chain
In recent years, various software supply chain SSC attacks have posed significant risks to the global community. Severe consequences may arise if developers integrate insecure code snippets that are vulnerable to SSC attacks into their products. Particularly, code generation techniques, such as...
Static Security Vulnerability Scanning of Proprietary and Open-Source Software: an Adaptable Process with Variants and Results
Software vulnerabilities remain a significant risk factor in achieving security objectives within software development organizations. This is especially true where either proprietary or open-source software OSS is included in the technological environment. In this paper an end-to-end process with...
Security Vulnerabilities in Software Supply Chain for Autonomous Vehicles
The interest in autonomous vehicles AVs for critical missions, including transportation, rescue, surveillance, reconnaissance, and mapping, is growing rapidly due to their significant safety and mobility benefits. AVs consist of complex software systems that leverage artificial intelligence AI,...
MAL-2025-47170 Malicious code in @nstudio/xplat-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57e90dbbaadf86b3e06a0b86bc92cf8e5545e60cf5c09fdfe1d22e59e56c67b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Establishing a Baseline of Software Supply Chain Security Task Adoption by Software Organizations
Software supply chain attacks have increased exponentially since 2020. The primary attack vectors for supply chain attacks are through: 1 software components; 2 the build infrastructure; and 3 humans a.k.a software practitioners. Software supply chain risk management frameworks provide a list of...
Malicious code in shengming-zhishu (npm)
The package shengming-zhishu was found to contain malicious code...
Malicious code in nurul-gulai26-breki (npm)
The package nurul-gulai26-breki was found to contain malicious code...
Malicious code in maxujun-xinzhi-baogao-erlingyibalingwu-lingqi (npm)
The package maxujun-xinzhi-baogao-erlingyibalingwu-lingqi was found to contain malicious code...
Malicious code in ruhe-peiyang-shouhuanyingde-haizi (npm)
The package ruhe-peiyang-shouhuanyingde-haizi was found to contain malicious code...
Malicious code in @teasource/veniam-officiis-rem (npm)
The package @teasource/veniam-officiis-rem was found to contain malicious code...
Malicious code in ruhe-zuohao-haizide-qingxu-jiaoyang (npm)
The package ruhe-zuohao-haizide-qingxu-jiaoyang was found to contain malicious code...
Malicious code in eclipse-sublimation-epigenetics-middleware (npm)
The package eclipse-sublimation-epigenetics-middleware was found to contain malicious code...
Malicious code in shuiku-jiaxue-wenji-hunlianpian (npm)
The package shuiku-jiaxue-wenji-hunlianpian was found to contain malicious code...
MAL-2025-46541 Malicious code in vina-tongseng51-kyuki (npm)
The package vina-tongseng51-kyuki was found to contain malicious code...
MAL-2025-46023 Malicious code in shenqide-jiechu-zhiliao (npm)
The package shenqide-jiechu-zhiliao was found to contain malicious code...
MAL-2025-46393 Malicious code in tujie-xiangzheng-zhanxingxue-quanshu (npm)
The package tujie-xiangzheng-zhanxingxue-quanshu was found to contain malicious code...
MAL-2025-43451 Malicious code in antares-native-ablation-soap (npm)
The package antares-native-ablation-soap was found to contain malicious code...