1
NPM lockfiles can be a security blindspot for injecting malicious modules in PRs
In this post, we show you how easy it is to introduce back doors that are easily missed by project owners… leaving your code insecure.
Snyk Blog
Every AI-building team faces one question: can you trust what you're shipping? Snyk secures the code AI writes, the agents it runs, and the apps it builds. Get started for free or book a demo.
- Popular posts
- 14
- Total points
- 2,894
- HN comments
- 1,262
- Rank
- #411 company
Visit snyk.io → On Hacker News Jul 2016 – Nov 2024
Security & Privacy 12Software Engineering 6Web & Frontend 2Open Source 2Infrastructure & DevOps 2Systems & Performance 1
2
Open source maintainer pulls the plug on NPM packages colors and faker
Snyk issued a Denial of Service security vulnerability for colors@1.4.1, following this vulnerable code. We highly recommend you revert to colors@1.4.0, and pin your dependencies’ versions to avoid blind upgrades of the offending version. We also recommend you migrate to a different package.
3
Kotlin becomes second most popular language on the JVM
Snyk's annual JVM ecosystem report presents the results of the largest annual survey on the JVM ecosystem, which gathered over 2000 responses in the second half of 2019.
4
Malicious remote code execution backdoor discovered bootstrap-sass Ruby gem
On March 26, 2019, a malicious version of the popular bootstrap-sass package, that has been downloaded a total of 28 million times to date, was published to the official RubyGems repository.
5
Building a backdoor with Node.js
A backdoor in our code that can perform OS injection is a considerable threat.
6
SourMint Malicious SDK
The Snyk security research team has made two significant disclosures surrounding the Mintegral SDK. Learn about these SourMint vulnerabilities.