All news with #dependency management tag

🐍 This report examines how the convenience and popularity of Python have attracted supply chain abuse, showing how malicious packages can execute code during installation and persist via .pth files or sitecustomize hooks. It outlines the installation layers (hosting, installation, environment), distribution formats (sdist, wheel), and common abuse techniques, emphasizing the rapid impact of compromised packages on development and enterprise assets.

🔒 GitHub released npm v12 which disables install scripts by default and deprecates 2FA-bypass granular access tokens. The update makes lifecycle scripts, Git dependencies, and remote URL deps opt-in, requiring an explicit approval workflow and an allowlist committed to package.json. It also restricts GAT capabilities for account and publishing actions, with staged publishing and OIDC recommended for automation.

🔐 Microsoft attributed a large-scale npm supply chain attack on the open-source Mastra TypeScript project to North Korea’s Sapphire Sleet group. The threat actor abused a compromised npm maintainer account to publish poisoned packages that disabled TLS verification and contacted attacker C2 servers to deploy cross-platform malware. The payload sought cryptocurrency wallet extensions and performed system reconnaissance, posing a significant risk to developers and downstream users. Microsoft advised auditing dependencies, checking for the malicious easy-day-js package and pinning known-good package versions.

🛡️ GitHub announced npm v12 will flip three permissive defaults to opt-in behavior to reduce software supply chain risk. Starting July 2026, npm will block install scripts, Git dependencies, and remote URL-sourced packages by default. Developers can upgrade to npm 11.16.0+ to receive warnings and use npm approve-scripts to build local allowlists in package.json. Experts praise stronger defaults but warn attackers may shift to private registries and maintainers may approve scripts to avoid build friction.

🔒 The RubyGems team added a cooldown option to Bundler to delay installing recently published gems, aiming to reduce exposure to software supply-chain attacks. The feature checks timestamps and ignores gems until they have been published for a configurable number of days, allowing time for malicious modifications to be discovered. Administrators can override the delay when rapid patching is required, balancing security and operational needs.

🔍 CVE Lite CLI is an OWASP-backed, open-source scanner for JavaScript and TypeScript lockfiles that emphasizes local, early feedback for dependency vulnerabilities. The tool inspects npm, pnpm, and Yarn lockfiles using OSV data, distinguishes direct vs transitive issues, and recommends practical upgrade paths. It is designed as a lightweight developer tool complementing, not replacing, enterprise SCA platforms and intentionally keeps core vulnerability analysis deterministic while offering AI as an explanatory layer.

🔍 The EOL blind spot in CVE feeds means scanners and SBOM tools routinely miss vulnerabilities in end-of-life open source versions because upstream advisories and CVE records typically list only actively supported ranges. HeroDevs and Sonatype data show maintainers lack the capacity to test legacy releases, producing widespread false negatives — HeroDevs estimates that for roughly 80% of CVEs on supported versions, EOL lines are also affected but unreported. The article uses CVE-2026-22732 in the Spring ecosystem to illustrate the problem and highlights a 12M+ version dataset that finds millions of EOL package versions and tens of thousands of EOL components with known CVEs. Use of HeroDevs EOL dataset or similar analysis is recommended to discover hidden exposure quickly.

⚠️ The article highlights a persistent blind spot: end-of-life (EOL) open-source versions frequently fall outside CVE affected ranges and thus don’t trigger SCA scanner alerts. Research from HeroDevs and Sonatype shows millions of EOL package versions and tens of thousands with known CVEs but no official fixes. Concrete Spring Security examples from 2026 illustrate how EOL users can remain exposed without warning. The piece urges improved visibility and proactive EOL scanning.

🔒 Modern vulnerability management must go beyond scanning version numbers to encompass download policies, AI guardrails, and build-pipeline controls. Organizations should adopt a trusted internal artifact registry, rigorous component screening, and dependency pinning to reduce supply-chain and malicious-package risks. Complement these controls with enriched vulnerability intelligence, SCA, and developer training. Systematic handling of EOL or abandoned components — via migration, LTS, or compensatory controls — completes the approach.

🔐 The npm ecosystem has shifted from simple typosquatting to coordinated, credential-driven supply‑chain intrusions that target maintainers, CI pipelines, and trusted automation. Attackers now compromise legitimate packages via stolen tokens and publish trojanized updates that quietly propagate to millions of downstream projects. Detection increasingly requires runtime and anomaly analysis rather than static scanning, while mitigations focus on treating CI runners as production assets, aggressively rotating and scoping publish tokens, disabling unnecessary lifecycle scripts, and pinning dependencies to immutable versions.

🔍 ReversingLabs uncovered a campaign that embedded malware in 19 Visual Studio Code extensions by tampering with bundled dependencies. Attackers replaced the widely used npm package path-is-absolute to execute a JavaScript dropper from a file named "lock" and hid two binaries inside an archive disguised as banner.png. The payloads were launched via cmstp.exe, including a process-terminating component and a Rust-based Trojan; Microsoft has been notified.

🛡️ Sonatype reports that 13% of Log4j downloads in 2025 — roughly 40 million of 300 million Maven Central downloads analyzed — remain vulnerable to the CVSS 10.0 Log4Shell flaw first disclosed four years ago. The vendor describes this as corrosive risk, where fixes exist but unsafe versions continue to spread because consumers don’t upgrade or transitive dependencies reintroduce bad releases. Sonatype highlights noisy SCA alerts, set-and-forget dependencies and poor selection criteria as root causes. It urges using SCA and artifact repositories to map exposure, automating upgrade PRs, enforcing repository guardrails and adopting new metrics to reduce unnecessary risk.

🧨 Check Point Research details the Shai-Hulud 2.0 campaign, a rapid and extensive npm supply-chain attack observed in November 2025. Between 21–23 November attackers compromised hundreds of npm packages and over 25,000 GitHub repositories by abusing the npm preinstall lifecycle script to execute payloads before installation completed. The report outlines techniques, scale, and practical mitigations to help organizations protect development pipelines.

📦 Researchers warn a large-scale spam campaign has flooded the npm registry with over 46,000 fake packages since early 2024, a coordinated, long-lived effort dubbed IndonesianFoods. The packages harbor a dormant worm in a single JavaScript file that only runs if a user manually executes commands like node auto.js, enabling automated self-publishing of thousands of junk packages. The campaign appears designed to waste registry resources, pollute search results, and possibly monetize via the Tea protocol; GitHub says it has removed the offending packages.

⚠️ AI-enabled supply chain attacks have surged in scale and sophistication, with malicious package uploads to open-source repositories rising 156% year-over-year and real incidents — from PyPI trojans to compromises of Hugging Face, GitHub and npm — already impacting production environments. These threats are polymorphic, context-aware, semantically camouflaged and temporally evasive, rendering signature-based tools increasingly ineffective. CISOs should prioritize AI-aware detection, behavioral provenance, runtime containment and strict contributor verification immediately to reduce exposure and satisfy emerging regulatory obligations such as the EU AI Act.

⚠️ A critical remote code execution vulnerability (CVE-2025-12735) has been disclosed in the popular expr-eval JavaScript expression parser, which sees over 800,000 weekly downloads on NPM. Reported by Jangwoo Choe and rated 9.8 by CISA, the flaw stems from insufficient validation of the variables/context object passed to Parser.evaluate(), allowing attacker-supplied function objects to be invoked during evaluation. Both the original project and its maintained fork are affected; the fork provides a fix in v3.0.0. Developers should migrate to the patched fork and republish dependent packages immediately.

⚠️ Socket has identified nine malicious NuGet packages published in 2023–2024 by the account "shanhai666" that contain time‑delayed logic bombs intended to sabotage database operations and industrial control systems. The most dangerous, Sharp7Extend, bundles the legitimate Sharp7 PLC library and uses C# extension methods plus an encrypted configuration to trigger probabilistic process terminations (≈20%) and silent PLC write failures (≈80% after 30–90 minutes). Several SQL-related packages are set to activate on staged dates in August 2027 and November 2028, and the packages were collectively downloaded 9,488 times. All nine malicious packages have been removed from NuGet; attribution remains uncertain.

🔒 Datadog Security researchers found 17 npm packages (23 releases) that used a postinstall downloader to execute the Vidar infostealer on Windows systems. The trojanized modules masqueraded as Telegram bot helpers, icon libraries, and forks of libraries like Cursor and React, and were available for about two weeks with at least 2,240 downloads before the accounts were banned. Organizations should adopt SBOMs, SCA, internal registries, add ignore-scripts policies, and enable real-time package scanning to reduce supply chain risk.