Sign up for our newsletter!
Stay informed on the latest DevOps news

DevOps.com

Tag: software supply chain attacks

IronWorm Malware Shares Shai-Hulud Traits, Takes Threat to 'Next Level'

IronWorm Malware Shares Shai-Hulud Traits, Takes Threat to ‘Next Level’

| | ebpf, IronWorm, jfrog, malware, Miasma, OX Security, Rust programming language, Shai-Hulud worm, software developers, software supply chain attacks, TeamPCP
Open source software developers continue to come under attack, with the latest threat being a custom malware that shares many of the attributes of the notorious Shai-Hulud self-propagating worm but comes with ...
DevsecOps software supply chain data, pipelines, data lineage

Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable

| | Aqua Security Trivy, CI/CD cyberthreats, exposed secrets, GitHub Actions, IANS Research, malicious code, microsoft, OWASP Top 10, remote code execution, software development security, software supply chain attacks, software vulnerabilities, Tenable
A critical vulnerability in a popular Microsoft GitHub repository could allow a threat actor to easily exploit its CI/CD infrastructure to run arbitrary code in the repository and gain access to secrets, ...
threat modeling, threat, security, secure design, threat modeling, supply chain Codenotary insider threats

Bad Actor Drops 36 Malicious Packages in npm, Targets Guardarian Users

| | credentials, cryptocurrency, docker containers, Guardarian, kubernetes, Lazarus Group, npm malware, Python, Redis, SafeDep, Secrets, Shai-Hulud, software supply chain attacks, sonatype, Strapi
The npm code repository is again being used by a bad actor to launch a supply chain attack that includes three dozen malicious packages that appear as Strapi CMS plugins but deliver ...
AI-based, software development, ai, code generation, repositories, GitHub, Arm, extension, GitHub, Copilot, Git, bloat, malicious, GitLab, memory-safe, CISA, agency, Skillsoft GitHub GitKraken code QA

Best of 2025: GitHub Action Compromise Risks Data Leaks for 23,000 Repositories

| | GitHub Actions, leaked secrets, Python, software supply chain attacks
The attacker introduced malicious Python code that would expose secrets like authentication credentials in public repositories ...
supply chain, software, Checkmarx, data, Endor, SCA, supply chain, security, workflows, supply chain, software, supply chain security, appsec, polyfill, software, supply chains, DevOps, DevSecOps, Google supply chain

Three Encryption Resolutions for DevSecOps in 2026  

| | AI supply chain attacks, automated certificate management, CA/B Forum code signing rules, certificate lifecycle management, CI/CD pipeline security, code signing certificates, dependency scanning security, DevSecOps compliance, DevSecOps New Year resolutions, DevSecOps supply chain security, open source supply chain risk, PKI for DevSecOps, secure software development lifecycle, self-signed certificate risks, software supply chain attacks
As supply chain attacks surge and AI-powered threats grow, DevSecOps teams must strengthen CI/CD security. Learn why PKI, code signing, and certificate automation are critical in the year ahead ...
AI-based, software development, ai, code generation, repositories, GitHub, Arm, extension, GitHub, Copilot, Git, bloat, malicious, GitLab, memory-safe, CISA, agency, Skillsoft GitHub GitKraken code QA

GitHub Action Compromise Risks Data Leaks for 23,000 Repositories

| | GitHub Actions, leaked secrets, Python, software supply chain attacks
The attacker introduced malicious Python code that would expose secrets like authentication credentials in public repositories ...
Typosquat Supply Chain Attack Targets Go Developers

Typosquat Supply Chain Attack Targets Go Developers

| | GitHub repositories, Golang, malicious code, software supply chain attacks
A backdoor that impersonates a widely used database module in the popular Go programming language can give hackers control of infected systems, according to a senior threat intelligence analyst with developer-focused platform ...
AI-based, software development, ai, code generation, repositories, GitHub, Arm, extension, GitHub, Copilot, Git, bloat, malicious, GitLab, memory-safe, CISA, agency, Skillsoft GitHub GitKraken code QA

More Than 3,000 ‘Ghost’ Accounts Spreading Malware on GitHub

| | GitHub repositories, malicious code, malware, software supply chain attacks
GitHub and similar open-source code and project repositories have become a common target of cybercriminals looking to lure developers into unknowingly downloading malicious scripts ...
npm is Scam-Spam Cesspool ¦ Google in Microsoft Antitrust Thrust

npm is Scam-Spam Cesspool ¦ Google in Microsoft Antitrust Thrust

| | Amit Zavery, azure, code repo, code repositories, code repository, GOOG, GOOGL, google, Google Cloud, IaaS, microsoft, Microsoft Azure, MSFT, NPM, npm registry, open source, public repository, Repos, repositories, repository, Repository Security, SEO, Software Supply Chain, software supply chain attacks, Software Supply Chain Security, Software Supply Chains, softwaresupplychain, source code repository, spam, supply chain, supply chain attacks, supply chain security, The Long View
In this week’s #TheLongView: The npm registry suffers spam infestation, and Microsoft makes Google sad ...
supply chain, software, Checkmarx, data, Endor, SCA, supply chain, security, workflows, supply chain, software, supply chain security, appsec, polyfill, software, supply chains, DevOps, DevSecOps, Google supply chain

Addressing Software Supply Chain Security

| | DAST, SAST, SCA, Software Supply Chain, software supply chain attacks, Software Supply Chain Security
It’s essential for organizations to learn more about the software supply chains they rely on and the steps needed to secure them. In just the past few years, we have seen a ...