Tag: package registry malware
North Korea Expands the Reach of PolinRider Supply Chain Attack Campaign
Jeff Burt | | AI supply chain attacks, APT37, Chrome Store, Contagious Interview, devops, devsecops, Famous Chollima, Go modules, Lazarus Group, malicious npm packages, North Korea, package registry malware, Packagist, PolinRider, Rescana, Socket, supply chainThe North Korean-sponsored threat groups behind the long-running fake interview scams targeting developers are expanding the PolinRider supply chain campaign that has escalated over the past several months. Reports from cybersecurity vendors ...
How GitHub Plans to Secure npm After Recent Supply Chain Attacks
Tom Smith | | API token deprecation, CI/CD authentication, crates.io security, npm 2FA, npm registry attack, npm token theft, open source security, package registry malware, PyPI trusted publishing, Shai-Hulud worm, Software Supply Chain Security, trusted publishingGitHub strengthens npm security after Shai-Hulud worm attack with mandatory 2FA, granular tokens, and trusted publishing to protect the open source supply chain ...
