As the Log4j vulnerability disclosures come out, and ongoing exploitation in the wild is on, we have been closely monitoring developments and tracking the gap between the disclosures and how fast the
On Friday, the news broke about Log4Shell, an easy-to-exploit vulnerability being exploited across the world. We have kept our blog up to date with the latest news, mitigations and strategies that
News broke early Friday morning of a serious 0-day remote code execution
A new malicious package, noblox.js-rpc was spotted on the npm registry this month that leverages the same techniques we saw before to steal all sorts of sensitive data like credentials, files, and
Just last week we saw the popular npm package `ua-parser-js` get hijacked. Malicious actors gained access to the project maintainer's npm account and published malicious versions that attempted to
The world was just coming to terms with the "ua-parser-js" npm library hijacking incident, and Sonatype's discovery of crypto-mining malware from last week, when we found a bigger, and spookier,
Last week, Sonatype reported our discovery of three malicious npm cryptomining packages on npm: klow, klown, and okhsa. These packages, which infiltrated the npm registry between October 12 and 15,
Sonatype's automated malware detection system has caught multiple malicious packages on the npm registry this month. These packages disguise themselves as legitimate JavaScript libraries but were
Spring Security provides security services for the Spring IO Platform, available on their GitHub repository. Today we focus on the "oauth2" client, which provides an application with the capability
Over the weekend, Sonatype spotted a rather unique malware sample published to the npm registry, within a day of its release on npm.
Guess who's back? Earlier this month, CVE-2021-22114 in spring-integration-zip, returned for the second time to cause havoc.
We've seen so many software supply chain attacks in recent weeks that it's hard for us to talk about all of them. But, in the last 24 hours, we've seen two major issues that are important for
