a Futurum companyTag
23 articles
Blogs
CI/CD cache poisoning can turn untrusted code into compromised releases. Learn how to secure caches, isolate workflows and protect software supply chains.
Showing 1–23 of 23
AI
The evolving Gheist campaign uses stolen GitHub tokens and malicious Actions workflows to extract repository secrets and cloud credentials. While GitHub protections have blocked ob…
Blogs
A growing wave of software supply chain attacks, including Shai-Hulud, Axios and LiteLLM, is exposing weaknesses in conventional security tooling. Malicious open-source packages ca…
Blogs
CrowdSec says attackers stole source code from about 170 private GitHub repositories after a TanStack npm supply chain attack exposed an OAuth token tied to a former employee.
AI
Cycode is adding workstation-level protection to stop developers and AI coding agents from downloading malicious or insufficiently vetted software packages.
Blogs
CI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern…
Blogs
Researchers at Aikido Security and Endor Labs are tracking a fast-spreading supply-chain attack that is compromising a wide range of npm software packages that combined have more t…
Blogs
GitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads.
Blogs
Modern software development moves at a pace that would have been unthinkable a decade ago. Organizations push updates on demand, respond to vulnerabilities within minutes, and inte…
AI
A newly discovered supply chain security flaw is once again putting a spotlight on inherent weaknesses in CI/CD pipelines and the growing interest among cyberthreat actors to explo…
Blogs
Homebrew, the unofficial but default package manager for many Apple Mac users, now has safeguards to prevent supply-chain attacks. The approach mimics how GitHub just fortified npm…
Blogs
The threat actor targeted a highly popular open source project with more than 100 million weekly downloads, creating a large “blast radius.”
DevSecOps
In the wake of the massive Shai-Hulud supply chain attack that ripped through npm late last year and compromised more than 700 packages and exposed 25,000 repositories, developers…
Contributed Content
Software supply chain security is steadily moving to the forefront of cybersecurity conversations. In the past, it has been overshadowed by a focus on malware outbreaks, ransomware…
Blogs
A malicious Rust package that was found to be downloading payloads aimed at stealing cryptocurrency was removed from the crates.io Rust package registry, along with another package…
Blogs
DevOps was supposed to make software delivery faster, safer and more reliable. For the most part, it has. But every so often, something nasty crawls out of the shadows and reminds…
AI
The Nx build system was hit by a supply chain attack dubbed “s1ngularity,” leaking thousands of secrets and exploiting AI tools for data theft.
Blogs
Organizations can maintain their DevOps momentum while protecting the software supply chain by shifting security left.
Blogs
In this week’s #TheLongView: The npm registry suffers spam infestation, and Microsoft makes Google sad.
Blogs
In this week’s #TheLongView: Denis Pushkarev is fed up with core-js freeloaders, and hundreds more malicious packages found at PyPI.
Blogs
More than a year after the massive SolarWinds cyberattack, targeted companies continue to feel its ramifications in both reputation and financial cost. Moreover, the global softwar…
Blogs
The open source software (OSS) supply chain is under attack. As evidenced by the recent Log4Shell vulnerability, the OSS supply chain is increasingly a focus for attackers seeking…
Blogs
DAOPS Foundation—a non-profit organization committed to accelerating global digital transformation through technical standardization—is hosting the first ever DAOPS Meetup on May 1…
