#software-supply-chain

#software-supply-chain

UK public sector organizations are highly vulnerable to cyberattacks due to limited visibility into their software supply chains.

Cybersecurity researchers have found malicious Python packages targeting developers disguised as coding assessments, part of an ongoing campaign linked to the Lazarus Group.

North Korea's Lazarus Group has launched a new malware campaign targeting cryptocurrency wallets and software supply chains.

A software supply chain attack on npm packages has persisted for over a year, embedding malware that steals data and mines cryptocurrency.

95% of organizations have critical risks in their software supply chain.

The JFrog report highlights security risks in the software supply chain, detailing threats from vulnerabilities, malicious packages, exposed secrets, and human error.

The U.S. and Russia are the biggest contributors to open source projects, which carry significant vulnerabilities.

Lineaje's Open Source Manager (OSM) with AI helps prioritize remediation efforts for DevOps teams.

OpenText and Secure Code Warrior simplify learning for developers on DevSecOps best practices and streamline security training access.

Endor Labs introduced analytics to assess challenges in upgrading open source packages, aiding DevSecOps in making informed decisions.

The software supply chain is currently at high risk, particularly with outdated open-source components leading to security vulnerabilities.

Stacklok donates Minder to OpenSSF, aiming to enhance open-source security through proactive checks and policies combined with cryptographic signing.

Artifact Attestations ensure integrity of artifacts in GitHub Actions by linking them to source code and build instructions.

GitHub implemented mandatory 2FA for code contributors to enhance software supply chain security.