A dependency firewall blocks malicious open-source packages at install time, a defense Aikido Intel says is necessary as it now analyzes up to 100,000 malicious packages daily, up from 20,000 a year a…
The npm account 'ai' publishes seven packages that collectively receive 964 million weekly downloads, yet none have npm provenance attestations. This single-publisher, no-provenance pattern mirrors re…
A supply chain attack compromised over 140 npm packages in the @mastra scope, including @mastra/core with 918K weekly downloads, by injecting a malicious dependency that executes a postinstall script …
Mitchell Hashimoto is advising developers to stop updating software dependencies and instead fork and trim libraries, updating only when user-facing issues arise. The recommendation follows a spring o…
Setting a minimum release age (cooldown) on dependencies is a low-effort, high-impact defense against supply-chain attacks, as most malicious packages are detected and removed within hours. All three …