Supply Chain Security
-
GitHub Tightens npm Publishing Security with 2FA, Short-Lived Tokens and Trusted Publishing
GitHub announced a sweeping set of security measures for npm publishing, including deprecating legacy tokens, migrating to FIDO-based 2FA, and introducing seven-day, short-lived granular tokens plus trusted publishing that uses OpenID Connect and cryptographic provenance attestations to bolster npm’s supply-chain security.
-
NIST Revamps Security Controls to Tighten Software Updates and Patch Management
NIST has revised its Security and Privacy Control Catalog to strengthen software update and patch management, introducing changes aimed at better incident response, root-cause analysis, and cyber resiliency to reduce the window of exposure in software supply chains.
-
Malicious Go module masquerades as SSH brute-forcer, exfiltrates credentials via Telegram bot, researchers say
Security researchers have identified a malicious Go module masquerading as an SSH brute-force tool that quietly exfiltrates credentials to a threat actor via Telegram. The module, golang-random-ip-ssh-bruteforce, targets random SSH services, disables host key verification, and relays harvested data to a Telegram bot, highlighting ongoing software supply chain and credential theft risks.
-
Google Unveils OSS Rebuild to Enhance Open Source Security Amid Supply Chain Threats
Google has launched OSS Rebuild, a new initiative designed to bolster the security of open-source package ecosystems by providing build provenance and mitigating software supply chain attacks.
-
Rising Threats in Supply Chain Security Demand Increased Vigilance and Strategy
As cyber adversaries infiltrate software and hardware supply chains, organizations must enhance their cybersecurity strategies, focusing on continuous monitoring and the use of advanced tools like Software Bill of Materials and artificial intelligence to combat emerging threats.
