Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1443 Security Engineers1023 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1443 Incident914 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1443 articlesSort byNewest·Trending

21,764 Malicious Packages: The axios Compromise and What It Reveals About Your Dependency Chain

Incident

Latest

4 min read

21,764 Malicious Packages: The axios Compromise and What It Reveals About Your Dependency Chain

What Happened In Q1 2026, Sonatype identified 21,764 open source malware packages across public repositories, with npm accounting for 75% of these. Three incidents highlighted how attackers exploit tr

For Security EngineersRead article

Docker AuthZ Bypass: Which Plugin Architecture Should You Deploy?

Standards

5 min read

Docker AuthZ Bypass: Which Plugin Architecture Should You Deploy?

CVE-2026-34040 scored 8.8 on the CVSS scale. It s a regression of vulnerabilities patched in 2019 and 2024. The fix is available in Docker Engine 29.3.1 and Docker Desktop 4.66.1. The real question is

For DevOps LeadersRead

North Korean Actors Compromised Axios npm Package: A Supply Chain Attack Teardown

Incident

3 min read

North Korean Actors Compromised Axios npm Package: A Supply Chain Attack Teardown

A recent compromise of the popular Axios npm package has highlighted critical gaps in supply chain security for software development teams. Google s Threat Intelligence Group attributed the breach of

For Security EngineersRead

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Standards

4 min read

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Your vulnerability management program is about to undergo a significant transformation. AI models that autonomously discover vulnerabilities at scale are now production tools. Your team needs a deploy

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

When Your Publisher Account Gets Suspended: Maintaining Critical Update Channels

General

5 min read

When Your Publisher Account Gets Suspended: Maintaining Critical Update Channels

Scope This guide addresses the operational and security risks when your team s publishing accounts—such as Microsoft Partner Center, Apple Developer, and Google Play Console—face suspension or access

For Compliance TeamsRead

Axios NPM Package Hijacked: Three Hours That Exposed Your Dependency Stack

Incident

5 min read

Axios NPM Package Hijacked: Three Hours That Exposed Your Dependency Stack

What Happened On March 30, 2026, attackers compromised the Axios NPM package by taking over a maintainer s account. Axios, a widely used HTTP client library in JavaScript, was injected with malicious

For Compliance TeamsRead

How Stolen Credentials Turned GitHub Actions Into a Malware Factory

Incident

5 min read

How Stolen Credentials Turned GitHub Actions Into a Malware Factory

What Happened TeamPCP compromised the CI/CD pipeline for Trivy, a widely-used vulnerability scanner, by stealing publishing credentials. They used these credentials to push malicious versions of both

For DevOps LeadersRead

Audio Steganography in Package Attacks: Detection and Response Guide

Standards

4 min read

Audio Steganography in Package Attacks: Detection and Response Guide

Scope This guide focuses on detecting and mitigating supply chain attacks that use audio steganography to hide malicious payloads in software packages. Our case study is the March 27, 2026 compromise

For Security EngineersRead

36 Malicious npm Packages Deployed Reverse Shells Through Strapi Plugin Typosquatting

Incident

4 min read

36 Malicious npm Packages Deployed Reverse Shells Through Strapi Plugin Typosquatting

What Happened SafeDep discovered 36 malicious npm packages posing as legitimate Strapi CMS plugins. These packages exploited Redis and PostgreSQL connections to deploy reverse shells and steal credent

For Security EngineersRead

766 Hosts Compromised in 24 Hours: The React2Shell Credential Theft Campaign

Incident

4 min read

766 Hosts Compromised in 24 Hours: The React2Shell Credential Theft Campaign

What Happened Between late 2024 and early 2025, attackers exploited the React2Shell vulnerability in Next.js applications to execute an automated credential theft campaign. Using a framework called NE

For Security EngineersRead

Security Fix Exists, But Your Users Are Still Vulnerable

Incident

4 min read

Security Fix Exists, But Your Users Are Still Vulnerable

What Happened Adversa discovered a vulnerability in Claude Code that allows attackers to bypass security controls by submitting more than 50 subcommands in a single request. When the system encounters

For Compliance TeamsRead

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

Standards

5 min read

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

A compromised maintainer account on npm deployed a cross-platform Remote Access Trojan (RAT) through malicious versions of Axios, a widely used JavaScript HTTP client library. If your systems ran npm

For Security EngineersRead

The Pre-Commit Secrets Policy Your Developers Will Actually Use

Standards

6 min read

The Pre-Commit Secrets Policy Your Developers Will Actually Use

Your team committed 29 million new hardcoded secrets to public repositories in 2025—a 34% increase from the previous year. AI services contributed to 81% more leaks year over year, and internal reposi

For CISOsRead

Should You Lock Down Your Package Repository or Monitor It?

Standards

5 min read

Should You Lock Down Your Package Repository or Monitor It?

The Telnyx SDK compromise on PyPI presents your security team with a critical decision: do you restrict package installation at the perimeter, or do you allow flexibility and invest in runtime detecti

For Compliance TeamsRead

A Security Scanner Becomes the Attack Vector: The Trivy Supply Chain Breach

Incident

4 min read

A Security Scanner Becomes the Attack Vector: The Trivy Supply Chain Breach

On March 19, 2026, TeamPCP compromised Aqua Security s Trivy vulnerability scanner—a tool millions of developers rely on to find security flaws. The attackers didn t exploit a zero-day in the scanner

For Compliance TeamsRead

56% of Vulnerable Magento Stores Hit Within 10 Days

Incident

5 min read

56% of Vulnerable Magento Stores Hit Within 10 Days

What Happened Mass exploitation of the PolyShell vulnerability in Magento Open Source and Adobe Commerce began on March 19th. Within days, attackers compromised 56.7% of all vulnerable stores. The att

For Compliance TeamsRead

Showing 1281-1296 of 1443 articles

PreviousPage 81 of 91Next