Open-source security is a mess - IBM and Red Hat bet $5 billion and 20,000 engineers can fix it

Open-source security is a mess - IBM and Red Hat bet $5 billion and 20,000 engineers can fix it ...
Microsoft

Malicious npm packages abuse dependency confusion to profile developer environments

Microsoft Threat Intelligence has uncovered an active supply chain attack involving malicious npm packages registered under organizational scopes that mirror real internal corporate namespaces, ...