Popular Go library fsnotify raises supply chain alarms after maintainer access changes
Summary
The popular Go library fsnotify has raised supply chain security concerns following changes to maintainer access.
Similar Articles
'No way to prevent this,' says only package manager where this regularly happens
Satirical article highlighting the recurring supply chain attacks in the npm registry, contrasting with more secure ecosystems like Go and Rust, and mocking the JavaScript community's acceptance of such vulnerabilities.
Disrupting supply chain attacks on NPM and GitHub Actions
GitHub announces new security measures for npm and GitHub Actions to disrupt common supply chain attack techniques, including preventive account protection for high-impact accounts and safer default checkout settings.
@altryne: PSA: If you are un-aware of the latest supply-chain attacks, or aware but complacent and didn't do anything, especially…
A PSA about a series of supply-chain attacks targeting AI developer tools (Hermes, OpenClaw) via npm and PyPI, specifically the 'Mini-Shai Hulud' worm that self-replicates and steals credentials, API keys, and browser sessions. The post advises sandboxed execution and restricting package age to mitigate risks.
@tan_stack: SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions tota…
A high-severity supply-chain compromise affected 42 TanStack npm packages, exfiltrating cloud credentials and SSH keys. Users are advised to rotate credentials and reinstall from clean lockfiles if they installed packages during the attack window.
Be alert: targeted attacks on prominent Rustaceans
An ongoing campaign is targeting prominent Rust developers through social engineering to compromise devices and publish malware, with recent supply chain attacks on crates like array ref highlighted. Recommended defense includes dependency cooldowns to mitigate risks.