A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and ...

Packagist packages hid malicious package.json scripts, enabling Linux binary execution during installs and workflows.

Dependency confusion is becoming a serious cybersecurity threat. Learn which organizations are at risk and how to protect systems against these attacks. Application development often requires the ...

This week, Google launched a free API service that provides software developers with dependency data and security-related information on over 5 million software components across different programming ...