Tagged: Software Supply Chain

September 24, 2025

GitHub Overhauls npm Security After a Self-Replicating Worm Attack

GitHub has announced sweeping changes to its npm authentication and package publication system, aimed at strengthening defenses against supply chain attacks. The catalyst for these reforms was the recent Shai-Hulud campaign—a malicious self-propagating worm...

Cybercriminals

August 5, 2025

Lazarus Group’s Covert Supply Chain Attack: North Korean APT Poisons Open Source to Steal Developer Secrets

In the first half of 2025, Sonatype uncovered a large-scale, ongoing assault on the open-source software ecosystem, orchestrated by the North Korean threat actor known as Lazarus. Sonatype’s automated malware detection systems were the...