DevSecOps
‘Flooding Dropper’ Is Hitting npm With a Tidal Wave of Malicious Packages
Jeff Burt | | Flooding Dropper, linux, macOS, malicious npm packages, Microsoft Windows, naming conventions, open source threats, OpenSourceMalware, sonatypeThreat researchers at Sonatype are warning developers of an expanding campaign that is generating a wide range of npm accounts and dropping small numbers of malicious packages from each one, essentially flooding ...
RapidFort Extends Open Source Software Security Reach to Runtime Environments
RapidFort today at the Black Hat USA conference announced it has extended its ability to secure open source software to the runtimes that DevOps teams deploy in production environments. Michael Wood, chief ...
Fast-Moving Shai-Hulud Attack Infects npm Packages with 2 Billion Monthly Downloads
Jeff Burt | | Aikido Security, AWS, credential theft, GitHub Actions, HashiCorp Terraform, npm malware, Shai-Hulud worm, supply chain attackResearchers at Aikido Security and Endor Labs are tracking a fast-spreading supply-chain attack that is compromising a wide range of npm software packages that combined have more than 2 billion installs a ...
FakeGit Targets AI Coding Agents with Malicious GitHub Repos
Jeff Burt | | AgentBaiting, AI coding agents, AI supply chain risk, Anthropic Claude Code, fake repositories, FakeGit, github, Google Gemini, Island, MCP Server, OpenAI ChatGPT, SmartLoader, StealCThreat actors continue to find new ways to incorporate AI into schemes aimed at luring developers into downloading malware from fake repositories. The latest example involves almost 7,600 malicious GitHub repositories that ...
Security Risks from AI Coding Agents Expand Beyond the Sandbox: Pillar
Jeff Burt | | AI code assistants, AI coding agents, AI Developers, AI sandbox, AI security risks, Cursor, Cymulate, Google Antigravity, Google Gemini, OpenAI Codex, Pillar Security, prompt injectionAI coding assistants have become an essential part of developers’ work, automating many of the repetitive tasks – think boilerplate coding and scaffolding – that in the past ate up a lot ...
Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem
Nigel Douglas | | AI coding agents, AntV packages, behavioural analysis, continuous scanning, dependency security, Developer Security, GitHub Actions compromise, malicious packages, Miasma worm, Mini Shai-Hulud, npm malware, OIDC tokens, open source security, package provenance, package quarantine, policy as code, Red Hat npm attack, registry scanning, Shai-Hulud worm, SLSA provenance, software attestation, Software Supply Chain Security, TanStack compromise, trusted pipeline attacksA developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore ...
xAI Open-Sources Grok Build Coding Agent After Cloud Upload Exposes SSH Keys, Repos
Tom Smith | | AI agent governance, AI coding agent, Apache 2.0, credential exposure, developer privacy, devops security, github, Grok Build, open-source coding agent, Repository Security, source code security, xAIxAI has published the full source code for Grok Build, its terminal-based AI coding agent, on GitHub under an Apache 2.0 license. The release lands three days after a security researcher showed ...
From AI Hype to AI Assurance: How Engineering Teams Can Safely Ship AI-Enabled Software
Olamilekan Lamidi | | AI assurance, AI Governance, AI testing, generative AI, MLOps, software engineeringAI has moved very quickly from experimentation to production. A few years ago, many organizations were still asking whether AI could improve their products or internal workflows. Today, the question is different: ...
GitHub API Abuse, ‘Ghost’ Accounts Part of Malicious Efforts to Map Organizations
Jeff Burt | | Cofense, Data Exfiltration, data mapping, data scraping, datadog, Fortran, GitHub API, GitHub ghost accounts, gitlab, GraphQL, personal tokens, REST APIsDatadog researchers uncover months-long overlapping campaigns to scrape data about companies and their developers ...
‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets
Jeff Burt | | AI coding agents, AI hallucinations, AI security agents, Cursor, devops, GitHub Copilot, Google Gemini, HalluSquatting, indirect prompt injection, LLM, OpenClaw, promptwareHallucinations have been an ongoing problem since OpenAI first introduced its ChatGPT chatbot in November 2022, highlighting generative AI’s tendency to generate plausible but false or misleading information and its inability to ...
How to Build a DevSecOps CI/CD Pipeline on Azure With GitHub Actions
Fix security problems when they’re cheap to fix, which is before the code is deployed. A pipeline that enforces this automatically is what makes that principle real ...
North Korea Expands the Reach of PolinRider Supply Chain Attack Campaign
Jeff Burt | | AI supply chain attacks, APT37, Chrome Store, Contagious Interview, devops, devsecops, Famous Chollima, Go modules, Lazarus Group, malicious npm packages, North Korea, package registry malware, Packagist, PolinRider, Rescana, Socket, supply chainThe North Korean-sponsored threat groups behind the long-running fake interview scams targeting developers are expanding the PolinRider supply chain campaign that has escalated over the past several months. Reports from cybersecurity vendors ...
