ransomware hospital — both words
"data breach" — exact phrase
malware -android — exclude a word
(apple OR microsoft) patch — either company, plus patch
ransom* — a wildcard match
Searches article titles, summaries, keywords and sources. Filters use publication dates.
1–10 of 45 articles
Best match · title matches first
Dark Reading
Researchers have identified dozens of malicious GlassWorm extensions that come with new evasion techniques.
Bleeping Computer
The defense mechanisms that NPM introduced after the 'Shai-Hulud' supply-chain attacks have weaknesses that allow threat actors to bypass them via Git dependencies. [...]
Dark Reading
In the "PhantomRaven" campaign, threat actors published 126 malicious npm packages that have flown under the radar, while collecting 86,000 downloads.
The Hacker News
Cybersecurity researchers have discovered a malicious package in the Python Package Index (PyPI) repository that introduces malicious behavior through a dependency that allows it to establish persistence and achieve code execution. The package, named termncolor, realizes its nefarious functionality through a dependency package called colorinal by means of a multi-stage malware operation, Zscaler
The Register
Who is the third party that does the thing in our thing? Yep. Attacks explode over past year The vast majority of global businesses are handling at least one material supply chain attack per year, but very few are doing enough to counter the growing threat.…
Bleeping Computer
A new class of supply chain attacks named 'slopsquatting' has emerged from the increased use of generative AI tools for coding and the model's tendency to "hallucinate" non-existent package names. [...]
The Register
Hallucinated package names fuel 'slopsquatting' The rise of AI-powered code generation tools is reshaping how developers write software - and introducing new risks to the software supply chain in the process.…
Dark Reading
There's never enough time or staff to scan code repositories. To avoid dependency confusion attacks, use automated CI/CD tools to make fixes in hard-to-manage software dependencies.
Bleeping Computer
Google has launched OSV Scanner, a new tool that allows developers to scan for vulnerabilities in open-source software dependencies used in their project. [...]
The Register
Security engineer outlines self-help strategy for keeping software supply chain safe Following the recent disclosure of a technique for hijacking certain NPM packages, security engineer Danish Tariq has proposed a defensive strategy for those looking to assess whether their web apps include dependencies tied to subvertable email domains.…