Software Engineer
Software Engineer
Introduction Software supply chains have become a focal point for attackers, as modern applications rely heavily on third-party and open-source dependencies. Organizations are adopting Software Bill of Materials (SBOM) documents to gain visibility into their software components. In this article,…
Hi guys, recently, I continued researching malicious dependencies and dependency confusion. This article is inspired by the article from 2024 and raises again concerns about the safety of downloading packages from public repositories without additional controls. Pypi.org allows packages to…
Dependency confusion attacks the supply chain security to deliver malicious code into the development environment. Developers use package manager systems to download packages (dependencies) and build projects. Usually, developers add some packages to the build file and initiate installing or…
Malware packages (aka malicious packages) lurk in NPM and PyPI — especially in NPM. If you’ve built front-end apps, you’ve likely used npm, pnpm, or yarn. You’ve probably tweaked package.json or run npm add something. These tools streamline dependency management. Each install…