Weaponizing the Commons: A Taxonomy and Detection Framework of Abuse on GitHub

GitHub plays a critical role in modern software supply chains, making its security an important research concern. Existing studies have primarily focused on CI/CD automation, collaboration patterns, and community management, while abuse behaviors on GitHub have received little systematic...

MAL-2026-2735 Malicious code in buildkite-test-collector-playwright-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9f3f80367ea53fbaf542c199729a13115d8d848157327188cf365303af1d1f3 The package buildkite-test-collector-playwright-example was found to contain malicious code...

Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management

Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for...

On the Variability of Source Code in Maven Package Rebuilds

Rebuilding packages from open source is a common practice to improve the security of software supply chains, and is now done at an industrial scale. The basic principle is to acquire the source code used to build a package published in a repository such as Maven Central for Java, rebuild the...

CVE-2026-23831

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate returns nil success when message is...

PT-2026-4280

Name of the Vulnerable Software and Affected Versions Rekor versions 1.4.3 and below Description Rekor’s entry implementation can experience a panic when processing attacker-controlled input during the canonicalization of a proposed entry with an empty spec.message. The validate function...

PT-2026-3860

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 12.3 through 18.6.3 GitLab CE/EE versions 18.7 through 18.7.1 GitLab CE/EE versions 18.8 through 18.8.1 Description An issue in GitLab CE/EE could allow an unauthenticated user to create a denial of service condition by...

Agentic AI for Autonomous Defense in Software Supply Chain Security: Beyond Provenance to Vulnerability Mitigation

The software supply chain attacks are becoming more and more focused on trusted development and delivery procedures, so the conventional post-build integrity mechanisms cannot be used anymore. The available frameworks like SLSA, SBOM and in toto are majorly used to offer provenance and traceabili...

EUVD-2025-205525

Malicious code in cryptozip PyPI...

CoTDeceptor:Adversarial Code Obfuscation against CoT-Enhanced LLM Code Agents

LLM-based code agentse.g., ChatGPT Codex are increasingly deployed as detector for code review and security auditing tasks. Although CoT-enhanced LLM vulnerability detectors are believed to provide improved robustness against obfuscated malicious code, we find that their reasoning chains and...

Malicious code in jsonupon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e934753e8b8ee104342730e5c20c02ad4724c9fdfdf889ffa8e026d141133cdc The package jsonupon was found to contain malicious code...

MAL-2025-192725 Malicious code in chai-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a153ef79c99f8b960c8e0557a16cb187571a31c3d4c2479e177ab630b36b6af6 The package chai-pack was found to contain malicious code...

EUVD-2025-202901

Malicious code in libxmljsololo3 npm...

EUVD-2025-201049

Malicious code in elf-stats-tinsel-train-397 npm...

MAL-2025-192124 Malicious code in elf-stats-rooftop-hammer-580 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00f8e0b61802c2ebee9fe5ddb54aee5ab39d5cd53e658b235a4543c99e91e383 The package elf-stats-rooftop-hammer-580 was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-200932

Malicious code in elf-stats-evergreen-bow-653 npm...

Malicious code in elf-stats-merry-chimney-765 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0435e21ddce3b9d114ac17bbe0bcb5977f29f67aed49768c7273851c2f70b703 The package elf-stats-merry-chimney-765 was found to contain malicious code...

A Comprehensive Study on the Impact of Vulnerable Dependencies on Open-Source Software

Open-source libraries are widely used by software developers to speed up the development of products, however, they can introduce security vulnerabilities, leading to incidents like Log4Shell. With the expanding usage of open-source libraries, it becomes even more imperative to comprehend and...

S3C2 SICP Summit 2025-06: Vulnerability Response Summit

Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing significant damage to businesses and organizations. The US and EU governments and industry are equally interested in enhancing software security, including supply chain and...

Exploring the SECURITY.Md in the Dependency Chain: Preliminary Analysis of the PyPI Ecosystem

Security policies, such as SECURITY.md files, are now common in open-source projects. They help guide responsible vulnerability reporting and build trust among users and contributors. Despite their growing use, it is still unclear how these policies influence the structure and evolution of softwa...