supply chain security news
3 stories
Is Cyber Facing an Affordability Crisis?
The cybersecurity industry is reportedly grappling with an affordability crisis, characterized by escalating costs associated with data breaches and substantial expenditures required for defensive measures. This situation is said to be disproportionately impacting small businesses, leaving them exposed to cyber threats. The reported vulnerability of these smaller entities, in turn, poses a…
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
A sophisticated new software supply chain attack, dubbed "ChainDrop," has been observed infecting over 400 npm packages, including widely used libraries such as `keyv` and `cacheable-request`. This attack leverages a three-step process to steal credentials and propagate itself, highlighting a growing trend of attackers targeting the tools and environments developers use rather than just…
The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent
Elastic has developed a new detection engineering method to track the removal of the `min-release-age` setting from `.npmrc` files on developer workstations. This setting, available since npm version 11.10, is designed to prevent the installation of recently published package versions, mitigating supply chain attacks such as Compromise Software Dependencies and Development Tools (T1195.001).