Hackers Supply Chain Attack Moves From npm to PyPI as Trivy Breach Extends into LiteLLM Package
Analysis of the TeamPCP supply chain attack linking Trivy, GitHub Actions, npm, and LiteLLM, including how the credential stealer works and what defenders should do next.
Beyond vulnerabilities: Detect malicious dependencies in your supply chainSemgrep
Detect Open Source Malware Attacks with Semgrep Supply ChainSemgrep
Sha1-Hulud: The Second Coming of the NPM Worm is Digging For SecretsSemgrep
London calling: Highlights from the 2025 cloud & cyber security expoSemgrep
Boosting Security Scan Performance for Monorepos with Multicore Parallel ProcessingSemgrep
Beyond Benchmarks: How Semgrep Redefines Javascript SecuritySemgrep
How We Eliminated Long-Lived CI Secrets Across 70+ ReposPulumi
Go Concurrency Patterns: Context - The Go Programming LanguageGo
NO_EXTERNAL_CSS_AT_IMPORTSVercel
How Mondelez Accelerates Supply Chain Training Across 150+ Global Manufacturing PlantsSynthesia
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI AttackSocket
Announcing Socket Certified Patches: One-Click Fixes for Vulnerable DependenciesSocket
Introducing Dependency Divergence GitHub ActionSocket
Updated and Ongoing Supply Chain Attack Targets CrowdStrike npm PackagesSocket
upm Launches as a Fast, Tiny Package Manager Written in TypeScriptSocket
Happy Birthday, Shai-HuludSocket
Off-The-Shelf Hacker: Adding MQTT and Cron to the Lawn Sprinkler ProjectThenewstack
Supply Chain Attacks and Cloud Native: What You Need to KnowThenewstack
Next-level IaC: Powering Up Pulumi with Package EcosystemsPulumi
Webinar Recap: Webinar Recap: Securing the Software Supply Chain with Docker BusinessDocker
