Sonatype is proud to be recognized as a Leader in The Forrester Wave™: SCA Software 2024. Forrester evaluated 10 top providers and named Sonatype a Leader among them. To us, this underscores our ...
A malicious release of TensorLake's TypeScript SDK, tensorlake@0.5.144, used an install hook to search for developer credentials and accept remote commands. Sonatype's code review found that its ...
Real-time intelligence, governance at selection, and agentic remediation help enterprises fix the risk that outpaces the speed of AI-driven assembly. Sonatype Research Labs also unveiled The AI-Era ...
The first defense for trustworthy software is deciding what enters the build. For years, a repository's job was to give developers a reliable place to find the packages and artifacts their projects ...
AI agents are choosing code and dependencies faster than teams can review them. In this video, Sonatype CTO and co-founder Brian Fox explains why the repository is a critical place to make those ...
Today’s enterprise repository is asked to manage a different software supply than it was built for a decade ago. Modern development increasingly draws from newer language ecosystems, rapidly expanding ...
Milestone: Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale: Sonatype Research Labs logged 149,329 open source malware ...
This morning, the widely used Python package litellm, a popular abstraction layer for interacting with large language models (LLMs), was compromised and two malicious versions released (1.82.7 and ...
As open source software continues to fortify modern applications, attackers are finding new and increasingly efficient ways to exploit the trust developers place in public ecosystems. Sonatype ...
An illicit npm package called 'crypto-encrypt-ts' may appear to revive the unmaintained but vastly popular CryptoJS library, but what it actually does is peek into your crypto wallet and exfiltrate ...
Malicious packages present a growing danger to software supply chains. From typosquatting attacks to sophisticated malware hidden within open source components, detecting and preventing malicious ...
At the end of Q2 2026, Sonatype Research reached 1.8 million malicious packages logged. In Q2, npm accounted for 96.6% of malicious package counts, with repository abuse and trojan-class activity ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results