Tag: Open Source Security
-
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google’s Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python …
-
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site’s server, and fixes were shipped on …
-
How Financial Services Companies Can Modernize Their Software Supply Chain
Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of …
-
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) …
-
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings …
-
Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages
The threat actors behind the supply chain attack targeting the popular Trivy scanner are suspected to be conducting follow-on attacks that …
-
ZAST.AI Raises $6M Pre-A to Scale “Zero False Positive” AI-Powered Code Security
January 5, 2026, Seattle, USA — ZAST.AI announced the completion of a $6 million Pre-A funding round. This investment came from the …
-
Fake Moltbot AI Coding Assistant on VS Code Marketplace Drops Malware
Cybersecurity researchers have flagged a new malicious Microsoft Visual Studio Code (VS Code) extension for Moltbot (formerly Clawdbot) on …
-
Webinar: Learn to Spot Risks and Patch Safely with Community-Maintained Tools
If you’re using community tools like Chocolatey or Winget to keep systems updated, you’re not alone. These platforms are fast, flexible, …
-
Malicious npm Packages Impersonate Flashbots, Steal Ethereum Wallet Keys
A new set of four malicious packages have been discovered in the npm package registry with capabilities to steal cryptocurrency wallet …
-
Open Source Security: Trends and Predictions for 2024
Open source security refers to the practice of ensuring that open source software (OSS) is free from vulnerabilities that malicious actors …
-
CISA Publishes Plan to Enhance Open Source Security
A leading US security agency has released a long-awaited plan detailing how it will enhance open source security for both federal …
●●●