Chainguard, the trusted foundation for software development and deployment, today announced Chainguard Libraries for JavaScript, a collection of trusted builds of thousands of common JavaScript ...

Chainguard Libraries for JavaScript include builds that are malware-resistant and built from source on SLSA L2 infrastructure ...

Newly discovered npm package 'fezbox' employs QR codes to hide a second-stage payload to steal cookies from a user's web browser. The package, masquerading as a utility library, leverages this ...

In light of recent cyberattacks and growing security concerns, GitHub is taking immediate and direct action to secure the ...

Process improvements and a closer look at funding streams will provide far more protection for the open source software we ...

The foundations said in their blog post that automated CI systems, large-scale dependency scanners, and ephemeral container ...

Two malicious packages with nearly 8,500 downloads in Rust's official crate repository scanned developers' systems to steal ...

North Korean-linked crews connected to the pervasive IT worker scams have upped their malware game, using more advanced tools ...

Plus: An investigation reveals how US tech companies reportedly helped build China’s sweeping surveillance state, and two ...

GitHub enforces FIDO 2FA and seven-day token limits after Shai-Hulud npm attack to boost supply chain security.

India’s cybersecurity agency warns of a fast-spreading npm supply chain worm, urging startups and ITes firms to secure ...

Explore emerging attack methods, evolving AI-driven threats, supply chain risks, and strategies to strengthen defenses and ...