Tag: Developer Security
Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem
Nigel Douglas | | AI coding agents, AntV packages, behavioural analysis, continuous scanning, dependency security, Developer Security, GitHub Actions compromise, malicious packages, Miasma worm, Mini Shai-Hulud, npm malware, OIDC tokens, open source security, package provenance, package quarantine, policy as code, Red Hat npm attack, registry scanning, Shai-Hulud worm, SLSA provenance, software attestation, Software Supply Chain Security, TanStack compromise, trusted pipeline attacksA developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore ...
Why Developer Workstations Have Become a Critical Part of the Software Supply Chain
Samuel Ogbonna | | CI/CD security, Developer Security, Developer Workstations, devsecops, open source security, Software Supply ChainFor years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest that this view is incomplete. The Megalodon campaign injected malicious ...
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
Jeff Burt | | AI coding agents, AI security risks, Anthropic Claude Code, Developer Security, exposed credentials, exposed secrets, Futurum Group, indirect prompt injection, leaked API keys, Mozilla 0DIN, shell scriptsA clean GitHub repository that contains no malicious code can launch an attack and fully compromise a developer’s systems by using indirect prompt injections to trick AI-powered coding agents like Anthropic’s Claude ...
Shift Left to the Developer’s Machine: Building Local Git Security Gates
Arun Sanna | | CI/CD security, code security, Credential Leakage, Defense in Depth, developer experience, Developer Security, devsecops, Git Hooks, Git Security, GitLeaks, Open Source Security Tools, Pre-Commit Hooks, secret detection, secrets management, shift left security, Software Supply Chain, static analysis, supply chain security, vulnerability scanningShift left to the developer's machine. The principle is what matters: Stop secrets before they ship. The tooling is a means to that end. ...
