Cybersecurity & Data Protection
2
UPVOTE
thehackernews.com

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

GitHub has announced what it said are "breaking changes" coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats. The changes aim to combat attack techniques that abuse the "npm install" command to trigger the execution of malicious code using npm lifecycle hooks. "Npm install" is used to download and install all the necessary
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
PR

phoebe rn

15d ago
2 0

Discussion

Be the first to comment

Add your perspective to get the discussion started.

No comments yet.

Be the first to share your take and keep the conversation moving.

Join the conversation

Log in or sign up to add your comment and participate in the discussion!

Log In Sign Up

UPVOTERS

Community appreciation

See who found this content valuable and showed their support.

thanakorn_boon477

Thanakorn Boon

Thanakorn BoonUpvoted 15d ago0 comments · 37 shares
PH

phoebe rn

phoebe rnUpvoted 15d ago0 comments · 24 shares

TOPICS

Explore the same topics

Discover more content from the topics this post is mapped to.

bleepingcomputer.com
Steam forum ClickFix attacks infect gamers with XMRig cryptomin…

Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptomin…
TA

taylor??

18h ago
0
thehackernews.com
Malvertising Sends Malware in Pieces, Then Makes the Browser Bu…

A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base…
PR

phoebe rn

20h ago
0
thehackernews.com
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patc…

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applica…
TN

The Hacker News

1d ago
0
thehackernews.com
Researcher Publishes GitLab RCE PoC Letting Authenticated Users…

Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed G…
TN

The Hacker News

1d ago
0
schneier.com
Friday Squid Blogging: Illex Squid Catch in the Falklands

Lower catch this year. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation…
SS

Schneier on Security

1d ago
0
bleepingcomputer.com
OnTrac notifies customers of data breach after network hack

OnTrac parcel delivery company is informing that hackers breached its corporate network and may have accessed personal details belonging to its customers. [. .…
Rosa Martinez

Rosa Martinez

1d ago
0

Keep browsing

Explore more from this topic

Dive into the full feed of curated posts covering Cybersecurity & Data Protection.

Browse Topics

RELATED CONTENT

Continue exploring

Discover more content that aligns with your interests and this post.

thehackernews.com
Malvertising Sends Malware in Pieces, Then Makes the Browser Bu…

A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base…
PR

phoebe rn

20h ago
0
thehackernews.com
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patc…

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applica…
TN

The Hacker News

1d ago
0
thehackernews.com
Researcher Publishes GitLab RCE PoC Letting Authenticated Users…

Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed G…
TN

The Hacker News

1d ago
0
thehackernews.com
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Mal…

The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an acti…
TN

The Hacker News

2d ago
0
thehackernews.com
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail…

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes afte…
Marcus Allen

Marcus Allen

2d ago
0
thehackernews.com
Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access …

Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a L…
SA

SariMartinez

3d ago
0

Still curious?

See more related posts

Keep the inspiration flowing with fresh submissions and trending finds from the community.

View Latest