Hijack an #npm package without stealing credentials? #GitHub Tightens npm Publishing After a "SlugFest" Flaw Left 1,500+ Packages Vulnerable to Hijacking:

#SoftwareSupplyChainSecurity
👇

Bloom Security uncovered a flaw in npm Trusted Publishing that exposed 1,500+ packages to potential malicious takeovers via GitHub.
#softwaresupplychainsecurity

#GitHub repos hit by a new supply chain attack - GhostAction attackers compromised maintainer accounts and injected malware into 346 repositories, including #Uber's athenadriver stealing cloud&AI credentials, CI/CD secrets:

#SoftwareSupplyChainSecurity
👇

HUGE NEWS! 📣

The "father of SBOM," @allanfriedman.bsky.social, is joining Anchore as a Board Advisor!

We sat down with him to discuss the future of #SoftwareSupplyChainSecurity and what comes after SBOM.... https://anchore.com/blog/anchore-welcomes-sbom-pioneer-dr-allan-friedman-as-board-advisor/