Experimental News Clipping Site

Tag: supply chain security

  • Hacker News: Malware found on NPM infecting local package with reverse shell

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.reversinglabs.com/blog/malicious-npm-patch-delivers-reverse-shell Source: Hacker News Title: Malware found on NPM infecting local package with reverse shell Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses the emergence of sophisticated malware on the npm package repository, specifically through malicious packages like ethers-provider2 and ethers-providerz, which exhibit advanced evasive techniques to compromise legitimate…

  • The Register: As nation-state hacking becomes ‘more in your face,’ are supply chains secure?

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/03/24/nation_state_supply_chain_attack/ Source: The Register Title: As nation-state hacking becomes ‘more in your face,’ are supply chains secure? Feedly Summary: Ex-US Air Force officer says companies shouldn’t wait for govt mandates Interview Former US Air Force cyber officer Sarah Cleveland worries about the threat of a major supply-chain attack from China or another adversarial…

  • Hacker News: NixOS and reproducible builds could have detected the xz backdoor

    —

    by

    Kurt Seifried
    in

    Source URL: https://luj.fr/blog/how-nixos-could-have-detected-xz.html Source: Hacker News Title: NixOS and reproducible builds could have detected the xz backdoor Feedly Summary: Comments AI Summary and Description: Yes Summary: The text details a significant security breach involving the open-source xz compression software, where a backdoor was inserted by a malicious maintainer. This event highlights the vulnerabilities within the…

  • Schneier on Security: Critical GitHub Attack

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.schneier.com/blog/archives/2025/03/critical-github-attack.html Source: Schneier on Security Title: Critical GitHub Attack Feedly Summary: This is serious: A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used “tj-actions/changed-files” utility, is now believed to have originated from an…

  • The Register: Too many software supply chain defense bibles? Boffins distill advice

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/03/20/software_supply_chain_defense/ Source: The Register Title: Too many software supply chain defense bibles? Boffins distill advice Feedly Summary: How to avoid another SolarWinds, Log4j, and XZ Utils situation Organizations concerned about software supply chain attacks should focus on role-based access control, system monitoring, and boundary protection, according to a new preprint paper on the…

  • Alerts: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 Source: Alerts Title: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066 Feedly Summary: A popular third-party GitHub Action, tj-actions/changed-files (tracked as CVE-2025-30066), was compromised. This GitHub Action is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets including,…

  • Cloud Blog: Cloud CISO Perspectives: 5 tips for secure AI success

    —

    by

    Kurt Seifried
    in

    Source URL: https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-5-tips-secure-ai-success/ Source: Cloud Blog Title: Cloud CISO Perspectives: 5 tips for secure AI success Feedly Summary: Welcome to the first Cloud CISO Perspectives for March 2025. Today, Royal Hansen, vice-president, Engineering, and Nick Godfrey, Office of the CISO senior director, discuss how new AI Protection capabilities in Security Command Center fit in with…

  • Anchore: Software Supply Chain Transparency: Why SBOMs Are the Missing Piece in Your ConMon Strategy

    —

    by

    Kurt Seifried
    in

    Source URL: https://anchore.com/blog/sboms-and-conmon-strengthen-software-supply-chain-security/ Source: Anchore Title: Software Supply Chain Transparency: Why SBOMs Are the Missing Piece in Your ConMon Strategy Feedly Summary: Two cybersecurity buzzwords are rapidly shaping how organizations manage risk and streamline operations: Continuous Monitoring (ConMon) and Software Bill of Materials (SBOMs). ConMon, rooted in the traditional security principle—“trust but verify”—has evolved into…

  • The Cloudflare Blog: Welcome to Security Week 2025

    —

    by

    Kurt Seifried
    in

    Source URL: https://blog.cloudflare.com/welcome-to-security-week-2025/ Source: The Cloudflare Blog Title: Welcome to Security Week 2025 Feedly Summary: Over the next week, we will discuss the latest trends in cyber security, announce new products and partnerships, and showcase the latest in Cloudflare technology. Welcome to Security Week 2025! AI Summary and Description: Yes Summary: The text outlines the…