devsecops news
4 stories
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
A sophisticated new software supply chain attack, dubbed "ChainDrop," has been observed infecting over 400 npm packages, including widely used libraries such as `keyv` and `cacheable-request`. This attack leverages a three-step process to steal credentials and propagate itself, highlighting a growing trend of attackers targeting the tools and environments developers use rather than just…
GitLab 19.3 helps enterprises scale agentic development securely
GitLab has released version 19.3 of its platform, introducing updates designed to enhance control and security for enterprises adopting agentic software development. Key features include the integration of the GitLab Duo Agent Platform into GitLab Dedicated environments, a new Secrets Manager, and tools for bulk SAST vulnerability remediation.
The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent
Elastic has developed a new detection engineering method to track the removal of the `min-release-age` setting from `.npmrc` files on developer workstations. This setting, available since npm version 11.10, is designed to prevent the installation of recently published package versions, mitigating supply chain attacks such as Compromise Software Dependencies and Development Tools (T1195.001).
The GitHub Actions Attack Pattern Your CI Security Scanners Miss
Researchers have identified a new class of vulnerabilities in Continuous Integration/Continuous Deployment (CI/CD) pipelines, dubbed "Cordyceps," which can be exploited by attackers with a free GitHub account. These weaknesses, disclosed by Novee Security, bypass traditional security scanning tools because they exploit the composition of workflow interactions rather than flaws within…