Sonatype Blog

Conversations about software supply automation, devsecops, open source, continuous delivery, and application security.

Visit blog.sonatype.com → RSS feedOn Hacker News Dec 2021 – Aug 2022

Sonatype identified a 'secretslib' PyPI package that covertly installs cryptominers on Linux systems.

Multiple Python packages caught by Sonatype were seen uploading secrets such as AWS keys and environment variables to a web endpoint.

Learn about the Log4j vulnerability and how you can combat it. Read this comprehensive guide to get actionable tips.