devops.com resources

devops.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-07-27.

Date Added	Resource	Excerpt
2026-07-27 2026	GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks Supply Chain	Library for application security that introduces time-based defenses against software supply chain attacks. GitHub's Dependabot now defaults to a three-day cooldown before opening pull requests for routine version updates, and PyPI restricts new files from being added to releases older than 14 days. These changes provide crucial time for maintainers and scanners to detect and mitigate malicious releases, complementing practices like using lockfiles, tightly scoped tokens, and human review.
2026-07-22 2026	Signed Attested and Malicious: The Software Supply Chain Has a Deepfake Problem Supply Chain	Library for detecting software supply chain "deepfakes," where malicious packages present legitimate SLSA provenance and signatures, making them indistinguishable to traditional scanners. This library focuses on behavioral analysis of package installation hooks, network calls, and version changes, alongside account activity monitoring, to identify anomalies like rapid, large-scale publishing or unexpected package behavior. It advocates for a control point between registries and developer machines, holding packages for examination before they enter the build process, and treating new versions with a holding period, as pioneered by efforts to combat worms like Miasma and Shai-Hulud.
2026-07-08 2026	North Korea Expands the Reach of PolinRider Supply Chain Attack Campaign Supply Chain	Analysis of the PolinRider supply chain attack campaign, attributed to North Korean groups Famous Chollima and APT37. This ongoing campaign, targeting open source ecosystems like npm, Packagist, Go modules, and the Chrome Store, utilizes obfuscated JavaScript loaders hidden within malicious packages and browser extensions. Attackers leverage techniques such as whitespace padding, deceptive .woff2 font files, VS Code task files, and Git history rewriting to compromise developer accounts and repositories. Subsequent payloads, including DEV#POPPER RAT and OmniStealer, are fetched from blockchain and RPC infrastructure, aiming to steal credentials, exfiltrate source code, and achieve lateral movement within organizations.
2026-06-22 2026	Homebrew to Packages: No ID No Service Supply Chain	Library update details Homebrew 6.0.0's new supply-chain security measures, which mimic npm's approach by requiring explicit user trust for third-party repositories and blocking untrusted installation scripts. This includes a "Guestlist" of pre-approved remote URLs and a `trusted` flag for state management, alongside Bubblewrap integration for sandboxing builds on Linux. Package maintainers and CI/CD pipelines may need to update installation instructions and scripts.
2026-06-10 2026	GitHub Takes Down 73 Microsoft Repos After Miasma Worm Attack Supply Chain	Writeup of the Miasma worm attack on Microsoft repositories, detailing its infiltration of 73 GitHub projects, including Azure and MicrosoftDocs. The worm, a variant of Mini Shai-Hulud, leveraged compromised contributor accounts to inject malicious commits that executed credential-harvesting payloads when code was opened in IDEs and AI coding tools like Claude Code, Gemini CLI, Cursor, and VS Code. This attack signifies a shift in software supply chain threats, targeting the developer environment itself as an attack surface rather than just installed packages.
2026-05-22 2026	Attackers Can Exploit a Claude Code RCE Flaw to Take Command of System RCE	Library for securing developer models, this entry details a critical RCE vulnerability in Anthropic's Claude Code (version 2.1.118). Attackers could exploit a parsing flaw in the `eagerParseCliFlag` function via crafted deeplinks to inject arbitrary commands, bypassing trust prompts and taking control of a victim's system. The vulnerability was discovered by Joernchen of 0day.click and has since been patched.
2026-04-21 2026	Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable Supply Chain	Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable https://ift.tt/nvuCc9x