Unsung GitHub Features Anchor Novel Hacker C2 Infrastructure
More and more hackers are choosing to host their malicious campaigns from public services, and they're pioneering new ways of…
Software Supply Chain Strategies to Parry Dependency Confusion Attacks
Bad actors practice to deceive package managers with a tangled web of methods. Here's how to hoist them by their…
North Korean hackers behind malicious VMConnect PyPI campaign
North Korean state-sponsored hackers are behind the VMConnect campaign that uploaded to the PyPI (Python Package Index) repository malicious packages,…
Lazarus hackers deploy fake VMware PyPI packages in VMConnect attacks
North Korean state-sponsored hackers have uploaded malicious packages to the PyPI (Python Package Index) repository, camouflaging one of them as…
Despite Post-Log4J Security Gains, Developers Can Still Improve
Developers need more software security safeguards earlier in the process, especially as AI becomes more common.
‘Nitrogen’ Ransomware Effort Lures IT Pros via Google, Bing Ads
Forget temps and new employees. A new malicious campaign compromises organizations through a high risk, high reward vector: IT professionals.
New Python tool checks NPM packages for manifest confusion issues
A security researcher and system administrator has developed a tool that can help users check for manifest mismatches in packages…
PyPI’s 2FA Requirements Don’t Go Far Enough, Researchers Say
The Python Package Index will require developers to better secure their accounts as cyberattacks ramp up, but protecting the software…
PyPI announces mandatory use of 2FA for all software publishers
The Python Package Index (PyPI) has announced that it will require every account that manages a project on the platform…
PyPI temporarily pauses new users, projects amid high volume of malware
PyPI, the official third-party registry of open source Python packages has temporarily suspended new users from signing up, and new…