.png "back to home page")
A new type of supply-chain attack with serious consequences is flourishing
— CK's Technology News (@CKsTechNews) March 8, 2021
Via:https://t.co/7jpEI74BHk
Source:https://t.co/QqiIbfg6cZ
Microsoft Guidance:https://t.co/Q8KU8OU5Jh pic.twitter.com/LG4LrjLhU2
Avoiding npm substitution attacks by @izs
— Adam Baldwin (@adam_baldwin) February 12, 2021
TL;DR
1. Use scopes for internal packages.
2. Use a .npmrc file in the root of a project to set the intended registry.
3. Take care when proxying.
4. Respond quickly to build failures.https://t.co/8VBHeXxLHZ
So by our calculations Dependency Confusion copycats number near 6k at this point, just yesterday we saw 1.5k more in npm. This follows well-established supply chain strategies. There is evidence not all of them are just security research. https://t.co/wXjkm5xAex
— Ilkka Turunen (@llkkaT) March 4, 2021
https://t.co/3o0obqmygC
— Trevor Seward (@NaupliusTrevor) March 6, 2021
Don't forget your if(true === true){console.log("true")}; package.
Can we replace JS package managers with something sane, yet?
More top-tier companies targeted by new type of potentially serious attack https://t.co/CLyUKPsW0h by @dangoodin001
— Ars Technica (@arstechnica) March 6, 2021
Article on the package substitution/name confusion attack on package managers to get malicious code into an engineering system - packages with names of internal packages but having malicious code that will get used if external favored over internal. https://t.co/vFCkEwgMO7
— Buck Hodges (@tfsbuck) March 7, 2021
PyPI and #npm flooded with ~5,000 dependency confusion packages named after popular #opensource components by a vigilante "to make everyone pay attention to software #supplychain attacks, because the risks are too great."https://t.co/hTF71daJpu
— Ax Sharma (@Ax_Sharma) March 3, 2021
#devops #securitynews #DevSecOps pic.twitter.com/GdcxAVaLQw
This is scary. I wonder if using a private npm namespace ("@\your-company") with a separately configured registry URL is enough to nerf it... I guess just make sure you also own that namespace on the public registry!https://t.co/Q7nYs7j8I8
— astro creep (@sambreed) February 10, 2021
So by our calculations Dependency Confusion copycats number near 6k at this point, just yesterday we saw 1.5k more in npm. This follows well-established supply chain strategies. There is evidence not all of them are just security research. https://t.co/wXjkm5xAex
— Ilkka Turunen (@llkkaT) March 4, 2021
PyPI and #npm flooded with ~5,000 dependency confusion packages named after popular #opensource components by a vigilante "to make everyone pay attention to software #supplychain attacks, because the risks are too great."https://t.co/hTF71daJpu
— Ax Sharma (@Ax_Sharma) March 3, 2021
#devops #securitynews #DevSecOps pic.twitter.com/GdcxAVaLQw
Avoiding #npm Substitution Attacks — Recently there have been some high profile examples of supply chain attacks on popular source code repositories, such as where fake or eponymous packages are published... || #JavaScript #NodeJS #WebDev https://t.co/VIdfWsUNdq pic.twitter.com/Teb8YXaArm
— Jay ????️ (@Jay52_TX) March 6, 2021
A new type of #supplychain attack with serious consequences is flourishing > https://t.co/iWHjNDpiD3 on @arstechnica#cybersecurity #security #cyberthreats #cyberattacks #databreaches #tech #business #leaders #leadership #CISO #CIO #CTO #CEO pic.twitter.com/jUOCF4hINs
— JC Gaillard (@Corix_JC) March 10, 2021
A new type of supply-chain attack with serious consequences is flourishing https://t.co/cElhAOr5pZ by @dangoodin001 @alxbrsn @Ax_Sharma @sonatype @contrastsec
— Elinor Mills (she/her) (@elinormills) March 8, 2021
? A new type of supply-chain attack with serious consequences is flourishing#cybersecurity
— Dr. ir Johannes Drooghaag (JD) ? (@DrJDrooghaag) March 7, 2021
@archonsec @BillMew @robmay70 @digitalcloudgal https://t.co/cmuYQk6J3l
It turns out that software is "curl | sh" all the way down: https://t.co/6inJn44RgN
— Kyle Rankin (@kylerankin) March 8, 2021
A new type of supply-chain attack with serious consequences is
— Sami Laiho (@samilaiho) March 7, 2021
flourishinghttps://t.co/0yHuXL8qev
"In weeks past, Apple, Microsoft, Tesla, and 32 other companies were targeted by a similar attack that allowed a security researcher to execute unauthorized code inside their networks." https://t.co/TdHjHg4oKn
— Martijn Rasser (@MartijnRasser) March 7, 2021
A new type of supply-chain attack with serious consequences is flourishing https://t.co/j6w62R0cmz
— The Cyber Security Hub™ (@TheCyberSecHub) March 6, 2021
“The goal of these attacks is to execute unauthorized code inside a target’s internal software build system. The technique works by uploading malicious packages to public code repositories and giving them a name that’s identical to a stored package”https://t.co/4b7M7HVCry
— John Hemmings (@JohnHemmings2) March 6, 2021
Sonatype에 따르면 의존성 혼동을 악용한 패키지가 npm에 5,000종 이상이고 합니다. https://t.co/ISUuf5S9Qe
— ?라루얀 / 말썽쟁이 구운 경단 ? (@LaruYan) March 7, 2021