“Just changing the repository name” is fatal. Breaking down the design flaw in Trusted Publishing

Reading this news, I groaned, 'The security mechanism itself has a hole in it.'Security firm Bloom Security discovered a flaw ...
The Hacker News

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub now expires unvalidated npm trusted publisher bindings after 48 hours to limit package hijacks through reclaimed ...
newsblaze

Bloom Security Finds a Software Supply Chain Risk Hiding in AI Coding Workflows

AI coding agents are increasingly capable of selecting dependencies, installing packages, and running code with limited human ...
The Next Web

How AI coding tools could amplify software supply-chain attacks

A slug flaw in npm Trusted Publishing exposed 1,500+ packages with 10m downloads. Bloom Security on what it means when AI ...
CXO Today

JFrog Launches First Security-Focused, Immutable Chart Repository for Helm, the Package Manager for Kubernetes

Offered Free for the Open Source Community, ChartCenter Delivers Access to Immutable Versions of Publicly Available Helm Charts, Along With Security Scanning and Metadata JFrog, the Universal DevOps ...
Morningstar%2c Inc.

Nexsan Launches Enterprise-Class Immutable Backup Storage Appliance Designed for Veeam Hardened Repository

Nexsan®, the pioneer of highly reliable, cost-effective enterprise-class storage solutions, today introduced the Nexsan VHR-SeriesTM – a fully integrated, enterprise-class Hardened Repository ...