devops.com resources

devops.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-09-02.

Date Added	Resource	Excerpt
2026-09-02 2026	CrowdStrike Moves to Secure Software Supply Chains at the Endpoint Supply Chain	Library for real-time supply chain attack protection that blocks malicious open-source packages at the endpoint, safeguarding both human developers and AI coding agents on Windows, macOS, and Linux. It intercepts package manager transactions before embedded code executes, providing DevSecOps teams visibility into compromised package installations and enabling automated remediation workflows, even against threats like STARDUST CHOLLIMA and eCrime actor ALTERED SPIDER.
2026-08-21 2026	Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack Supply Chain	Library compromising the popular `arrayref` Rust crate and related packages (`append-only-vec`, `internment`) via a supply-chain attack using a typosquatted dependency (`proc-macro1`) to execute an information-stealing payload at compile time. The attack involved impersonating a developer, yanking legitimate versions to lure developers to malicious releases, and exfiltrating credentials and system information. Overlap in infrastructure suggests links to North Korean-linked threat actors, specifically Sapphire Sleet and UNC1069.
2026-08-20 2026	Critical Flaw in isolated-vm Can Lead to Sandbox Escape RCE Threat RCE	Library flaw in isolated-vm allows sandbox escape RCE. A time-of-check to time-of-use vulnerability in the ExternalCopy mechanism, tracked as GHSA-864f-rcv7-6rh4, enables malicious code within a Node.js sandbox to corrupt host process memory. This critical bug, affecting a library used by over a million projects weekly, can lead to host process hijacking and remote code execution. Developers should upgrade to isolated-vm versions 7.0.1 or 6.2.0.
2026-07-27 2026	GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks Supply Chain	Library for application security that introduces time-based defenses against software supply chain attacks. GitHub's Dependabot now defaults to a three-day cooldown before opening pull requests for routine version updates, and PyPI restricts new files from being added to releases older than 14 days. These changes provide crucial time for maintainers and scanners to detect and mitigate malicious releases, complementing practices like using lockfiles, tightly scoped tokens, and human review.
2026-07-22 2026	Signed Attested and Malicious: The Software Supply Chain Has a Deepfake Problem Supply Chain	Library for detecting software supply chain "deepfakes," where malicious packages present legitimate SLSA provenance and signatures, making them indistinguishable to traditional scanners. This library focuses on behavioral analysis of package installation hooks, network calls, and version changes, alongside account activity monitoring, to identify anomalies like rapid, large-scale publishing or unexpected package behavior. It advocates for a control point between registries and developer machines, holding packages for examination before they enter the build process, and treating new versions with a holding period, as pioneered by efforts to combat worms like Miasma and Shai-Hulud.
2026-06-22 2026	Homebrew to Packages: No ID No Service Supply Chain	Library update details Homebrew 6.0.0's new supply-chain security measures, which mimic npm's approach by requiring explicit user trust for third-party repositories and blocking untrusted installation scripts. This includes a "Guestlist" of pre-approved remote URLs and a `trusted` flag for state management, alongside Bubblewrap integration for sandboxing builds on Linux. Package maintainers and CI/CD pipelines may need to update installation instructions and scripts.
2026-05-22 2026	Attackers Can Exploit a Claude Code RCE Flaw to Take Command of System RCE	Library for securing developer models, this entry details a critical RCE vulnerability in Anthropic's Claude Code (version 2.1.118). Attackers could exploit a parsing flaw in the `eagerParseCliFlag` function via crafted deeplinks to inject arbitrary commands, bypassing trust prompts and taking control of a victim's system. The vulnerability was discovered by Joernchen of 0day.click and has since been patched.
2026-04-21 2026	Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable Supply Chain	Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable https://ift.tt/nvuCc9x