Software Supply Chain Security

Open-Source Dependencies Automotive Software Bills of Materials Open-Source Ecosystem Attacks Monorepository Access Control Git Hook Integrity Protection Package Registry Security Compromised Software Releases Open-Source Package Compromise AI Model Provenance and Dependencies Python Package Compromise

3 ARTICLES

7h ago

Malicious AGENTS.md in Downloads Can Make AI Coding Agents Run Malware

Proof-of-concept tests show agents will obey plain-text instruction files in their working folder, exposing them to files that browsers can save silently to the Downloads directory.

Stories older than 24h

13 ARTICLES

3d ago

Malicious LiteLLM v1.107.0 Published to PyPI and Container Registries

4 ARTICLES

5d ago

OVHcloud CLI Releases Hijacked on GitHub to Deliver Secrets-Stealer

3 ARTICLES

last wk.

ConnectWise Cloud Backup Credential Used to Access More Than 160 Microsoft 365 Tenants

6 ARTICLES

last wk.

Anthropic Replaces Git With Scion to Handle Tenfold Surge in Agent Merges

3 ARTICLES

last wk.

GitHub Tightens npm Trusted Publishing After Slug-Based Hijack Flaw