581 matches found
A Comprehensive Study on the Impact of Vulnerable Dependencies on Open-Source Software
Open-source libraries are widely used by software developers to speed up the development of products, however, they can introduce security vulnerabilities, leading to incidents like Log4Shell. With the expanding usage of open-source libraries, it becomes even more imperative to comprehend and...
S3C2 SICP Summit 2025-06: Vulnerability Response Summit
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing significant damage to businesses and organizations. The US and EU governments and industry are equally interested in enhancing software security, including supply chain and...
Exploring the SECURITY.Md in the Dependency Chain: Preliminary Analysis of the PyPI Ecosystem
Security policies, such as SECURITY.md files, are now common in open-source projects. They help guide responsible vulnerability reporting and build trust among users and contributors. Despite their growing use, it is still unclear how these policies influence the structure and evolution of softwa...
Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems
Shai-hulud 2.0 campaign features a sophisticated variant capable of stealing credentials and secrets from major cloud platforms and developer services, while automating the backdooring of NPM packages maintained by victims. Its advanced tactics enable rapid, stealthy propagation across the softwa...
A Reality Check on SBOM-Based Vulnerability Management: An Empirical Study and a Path Forward
The Software Bill of Materials SBOM is a critical tool for securing the software supply chain SSC, but its practical utility is undermined by inaccuracies in both its generation and its application in vulnerability scanning. This paper presents a large-scale empirical study on 2,414 open-source...
EUVD-2025-199323
Malicious code in @everreal/react-charts npm...
EUVD-2025-199022
Malicious code in template-lib npm...
EUVD-2025-198331
Malicious code in @ra-ftds/ra-flourish-design-tokens npm...
Finding Software Supply Chain Attack Paths with Logical Attack Graphs
Cyberattacks are becoming increasingly frequent and sophisticated, often exploiting the software supply chain SSC as an attack vector. Attack graphs provide a detailed representation of the sequence of events and vulnerabilities that could lead to a successful security breach in a system. MulVal ...
EUVD-2025-178583
Malicious code in hawkingradiation-xenobiology-prettier-stylelint-buffer npm...
EUVD-2025-175427
Malicious code in zenobia-colors-neptunology-darkmatter npm...
EUVD-2025-177966
Malicious code in magnetosphere-quito-isostasy-despina npm...
EUVD-2025-180020
Malicious code in blueshift-exoplanet-buffer-primatology npm...
EUVD-2025-138088
Malicious code in avarage-olios-noilagagi npm...
EUVD-2025-138044
Malicious code in flights-inlutag-iduliabisa npm...
EUVD-2025-137097
Malicious code in imodiov-kufni-uavcseqaba npm...
EUVD-2025-136041
Malicious code in itale-dci-rr npm...
EUVD-2025-138139
Malicious code in avangs-olium-nilvaint npm...