BestHub
Sign in
Tagged articles
47 articles
Page 1 of 1
21CTO
21CTO
Apr 20, 2026 · Information Security

How Anthropic’s Opus Model Generates Real‑World Chrome Exploits and What It Means for Security

Anthropic’s Opus 4.6 model can automatically craft a working V8 JavaScript engine exploit for Chrome 138, costing $2,283 in API usage, which demonstrates how AI‑driven code generation is reshaping vulnerability research, shortening patch windows, and forcing a rethink of software security practices.

AI securityChrome vulnerabilityOpus model
0 likes · 7 min read
How Anthropic’s Opus Model Generates Real‑World Chrome Exploits and What It Means for Security
AI Large-Model Wave and Transformation Guide
AI Large-Model Wave and Transformation Guide
Apr 2, 2026 · Information Security

What the Claude Code Source Leak Exposes About AI Tool Security

The accidental publication of 512,000 lines of Claude Code's TypeScript source via a mis‑packaged .map file sparked a rapid 48‑hour crisis that exposed internal APIs, feature flags, and unreleased features, prompting a deep technical dissection, impact analysis on users, Anthropic, and the broader AI industry, and a set of concrete security recommendations for AI product development.

AI securityClaude CodeDevOps
0 likes · 10 min read
What the Claude Code Source Leak Exposes About AI Tool Security
ITPUB
ITPUB
Apr 1, 2026 · Industry Insights

What a 59.8 MB Source Map Revealed About Claude Code’s Architecture and Security

A misconfigured npm package unintentionally published a massive source‑map that exposed over 1,900 files and 51,000 lines of Claude Code’s TypeScript, unveiling its full architecture, hidden features, and security flaws while prompting industry‑wide lessons on supply‑chain hygiene and AI safety.

AI securityAnthropicClaude Code
0 likes · 8 min read
What a 59.8 MB Source Map Revealed About Claude Code’s Architecture and Security
21CTO
21CTO
Apr 1, 2026 · Information Security

What the Claude Code Leak Reveals About Build‑Pipeline Security

A security researcher uncovered a massive Claude Code source leak caused by an npm map file, leading to a public GitHub repository with over 1,900 TypeScript files, prompting analysis of the mistake, Anthropic’s response, and the broader implications for software supply‑chain security.

AnthropicClaude CodeGitHub
0 likes · 5 min read
What the Claude Code Leak Reveals About Build‑Pipeline Security
ShiZhen AI
ShiZhen AI
Mar 31, 2026 · Information Security

Claude Code source map leak exposes 1,900+ files and hidden features

A mistakenly published source‑map file in Anthropic’s @anthropic‑ai/claude‑code npm package revealed over 1,900 TypeScript source files, 512,000 lines of code, and several unreleased “easter‑egg” features, prompting a community scramble and highlighting repeat supply‑chain oversights.

AnthropicClaude Codehidden features
0 likes · 9 min read
Claude Code source map leak exposes 1,900+ files and hidden features
IT Services Circle
IT Services Circle
Mar 28, 2026 · Information Security

How a Malicious litellm Update Turned Python AI Tools into a Supply‑Chain Bomb

On March 24, former OpenAI researcher Andrej Karpathy warned that a textbook‑level supply‑chain attack compromised the popular Python library litellm via a malicious .pth file, allowing automatic execution of code that harvests SSH keys, cloud credentials, and other secrets, with the breach traced back to a hijacked Trivy CI/CD pipeline.

Python securitysoftware supply chain
0 likes · 8 min read
How a Malicious litellm Update Turned Python AI Tools into a Supply‑Chain Bomb
AI Explorer
AI Explorer
Mar 18, 2026 · Information Security

How Tech Giants’ $12.5M Investment Is Transforming Open‑Source Security

Microsoft, Google and the OpenSSF have pledged $12.5 million to the Linux Foundation, aiming to shift open‑source security from volunteer‑driven maintenance to a systematic, corporate‑backed defense that safeguards critical infrastructure while balancing community autonomy.

Alpha-OmegaLinux FoundationOpenSSF
0 likes · 7 min read
How Tech Giants’ $12.5M Investment Is Transforming Open‑Source Security
DevOps in Software Development
DevOps in Software Development
Dec 1, 2025 · Information Security

Why Trusted Component Repositories Are Critical for Military Software Security

The article examines how modern military software, built largely from third‑party components, faces supply‑chain attacks, explains the need for SBOMs, and proposes a centralized trusted component repository with automated scanning, compliance checks, and full‑lifecycle auditing to secure defense systems.

DevOpsSBOMVulnerability Management
0 likes · 8 min read
Why Trusted Component Repositories Are Critical for Military Software Security
Continuous Delivery 2.0
Continuous Delivery 2.0
Nov 25, 2025 · Information Security

How SBOM and SLSA Transform Software Supply Chain Security and Boost ROI

This article examines the core applications of Software Bill of Materials (SBOM) and the SLSA framework across vulnerability response, license compliance, merger due‑diligence, and container image integrity, quantifies their return on investment, and showcases real‑world implementations by leading tech firms, highlighting how they enhance enterprise security, operational efficiency, and competitive advantage.

ROISBOMSLSA
0 likes · 17 min read
How SBOM and SLSA Transform Software Supply Chain Security and Boost ROI
Continuous Delivery 2.0
Continuous Delivery 2.0
Nov 21, 2025 · Information Security

How Google, Microsoft, and Meta Are Shaping SBOM Practices for Secure Software Supply Chains

This article examines the distinct SBOM strategies of Google, Microsoft, and Meta, highlighting Google's large‑scale automation, Microsoft's open‑source tooling, and Meta's internal security integration, and draws lessons for enterprises seeking transparent and resilient software supply chain governance.

Cloud NativeDevOpsOpen standards
0 likes · 10 min read
How Google, Microsoft, and Meta Are Shaping SBOM Practices for Secure Software Supply Chains
Continuous Delivery 2.0
Continuous Delivery 2.0
Nov 20, 2025 · Information Security

Why SBOM Is Critical for Modern Software Security and How to Choose Between SPDX and CycloneDX

The article explains what a Software Bill of Materials (SBOM) is, why it has become a strategic security requirement, compares the leading SPDX and CycloneDX standards, examines China's emerging DSDX format, and offers practical guidance on selecting the right SBOM format and tools for various compliance and risk‑management scenarios.

CycloneDXSBOMSPDX
0 likes · 13 min read
Why SBOM Is Critical for Modern Software Security and How to Choose Between SPDX and CycloneDX
DevOps in Software Development
DevOps in Software Development
Aug 29, 2025 · Information Security

How Trusted Dependency Libraries Secure Industrial Software Supply Chains

This article analyzes the strategic importance of software supply‑chain security for industrial equipment, outlines challenges such as network isolation, fragmented management, compliance audits, zombie components and supply‑cut risks, and presents a full‑link trusted dependency library architecture that delivers security, efficiency, compliance and strategic autonomy.

Securityarchitecturecompliance
0 likes · 22 min read
How Trusted Dependency Libraries Secure Industrial Software Supply Chains
21CTO
21CTO
Jun 21, 2025 · Information Security

Malicious Python Packages Hijacking Open‑Source Repos: The Banana Squad Threat

Security researchers at ReversingLabs have uncovered a coordinated campaign by the “Banana Squad” that injects malicious Python toolkits into hundreds of seemingly legitimate open‑source GitHub repositories, using domain squatting, repository impersonation, and hidden code obfuscation to steal sensitive data and evade detection.

GitHubReversingLabsmalicious Python packages
0 likes · 5 min read
Malicious Python Packages Hijacking Open‑Source Repos: The Banana Squad Threat
21CTO
21CTO
Jun 20, 2025 · Artificial Intelligence

AI Is Writing Code at Scale—Who’s Checking It?

Recent surveys reveal that over half of code in many organizations is now generated by AI, often deployed without review, raising significant supply‑chain security risks; developers express concern that AI amplifies malicious software threats, while current trust models and tooling lag behind the rapid adoption.

AI code generationAI ethicsArtifact Management
0 likes · 5 min read
AI Is Writing Code at Scale—Who’s Checking It?
Continuous Delivery 2.0
Continuous Delivery 2.0
Jun 8, 2025 · Information Security

Why SBOMs Are the Key to Secure Software Supply Chains

This article explains how Software Bill of Materials (SBOM) mirrors hardware BOMs, outlines their core differences, presents best practices, tools, and implementation strategies to improve supply‑chain transparency, compliance, and security for modern software development.

SBOMSecuritycompliance
0 likes · 12 min read
Why SBOMs Are the Key to Secure Software Supply Chains
Continuous Delivery 2.0
Continuous Delivery 2.0
Jun 7, 2025 · Information Security

Unlocking Software Supply Chain Security with SBOM

This article explains how Software Bill of Materials (SBOM) serves as a digital map for component dependency and change management, detailing its functions in visualizing dependencies, detecting version conflicts, ensuring license compliance, and providing supply‑chain risk alerts, ultimately improving development efficiency, security, and regulatory compliance.

SBOMSecuritycompliance
0 likes · 11 min read
Unlocking Software Supply Chain Security with SBOM
21CTO
21CTO
Apr 3, 2025 · Information Security

Why 56% of Open‑Source Packages Trigger Data Leaks – Sonatype’s Q1 2025 Malware Index

Sonatype’s Q1 2025 Open‑Source Malware Index identified 17,954 malicious packages—including hijacked npm crypto modules, a fake Truffle for VS Code extension, and counterfeit Solana packages—revealing that 56% of these components are associated with data breaches, a sharp rise from the 26% reported in Q4 2024, and highlighting the growing prevalence of complex, threat‑laden malware such as droppers and code‑injection threats.

data breachinformation securitymalware
0 likes · 2 min read
Why 56% of Open‑Source Packages Trigger Data Leaks – Sonatype’s Q1 2025 Malware Index
Tencent Technical Engineering
Tencent Technical Engineering
Mar 27, 2025 · Information Security

AI Programming Assistants Can Be Hijacked: Configuration File Poisoning and Security Risks

AI programming assistants such as GitHub Copilot and Cursor can be hijacked through poisoned configuration files that hide malicious prompts using invisible Unicode characters, exposing developers to risks like data leakage, DDoS, cryptomining and trojan injection, so they must avoid unknown configs, sandbox generated code, and employ static analysis and AI audits to mitigate threats.

AI securitycode poisoningconfiguration files
0 likes · 12 min read
AI Programming Assistants Can Be Hijacked: Configuration File Poisoning and Security Risks
DevOps
DevOps
Nov 26, 2024 · Information Security

10 Best‑Practice Principles for Implementing a Secure Development Lifecycle (SDL)

This article outlines ten essential best‑practice principles for implementing a Secure Development Lifecycle (SDL), covering top‑down leadership, alignment with existing management systems, visualizable processes, security goal classification, componentized security capabilities, supply‑chain management, service‑oriented SDL, DevSecOps toolchains, continuous optimization, and staff training.

DevSecOpsSDLSecure Development
0 likes · 17 min read
10 Best‑Practice Principles for Implementing a Secure Development Lifecycle (SDL)
21CTO
21CTO
Sep 5, 2024 · Information Security

Can Deleted PyPI Packages Be Hijacked? What It Means for Your CI/CD Security

JFrog’s security team reveals that attackers can hijack deleted PyPI packages by re‑registering the same name, tricking tools like Jenkins into installing malicious code, and outlines the scale of the risk, real‑world examples, and new defenses introduced by PyPI.

PyPI securityci/cdmalware
0 likes · 6 min read
Can Deleted PyPI Packages Be Hijacked? What It Means for Your CI/CD Security
IT Services Circle
IT Services Circle
Jun 15, 2024 · Information Security

How Researchers Built a Malicious VSCode Extension in 30 Minutes and Exposed Marketplace Security Flaws

A security research team created a counterfeit VSCode extension in half an hour, demonstrated how easily malicious code can be injected and distributed through the VSCode Marketplace, and revealed that dozens of high‑value companies, security firms and even a national court were compromised, highlighting critical gaps in extension vetting and supply‑chain protection.

VSCodeinformation securitymalicious extension
0 likes · 10 min read
How Researchers Built a Malicious VSCode Extension in 30 Minutes and Exposed Marketplace Security Flaws
Alibaba Cloud Developer
Alibaba Cloud Developer
Feb 18, 2024 · Operations

Why Software Supply Chain Consistency Is the Hidden Cost of Scaling

Software development involves both value‑creating features and unavoidable maintenance costs; this article explains how the hidden software supply chain—frameworks, libraries, runtime, cloud services, and configurations—creates consistency challenges, and proposes strategies such as explicit declarations, IaC, serverless, and mono‑repo to reduce scaling costs.

OperationsScalabilityServerless
0 likes · 21 min read
Why Software Supply Chain Consistency Is the Hidden Cost of Scaling
DevOps
DevOps
Nov 9, 2023 · Information Security

Introducing SLSA: An End‑to‑End Framework for Software Supply Chain Integrity

This article translates Google's SLSA framework paper, explaining software supply chain threats, the four SLSA levels, mitigation strategies, a provenance generation example, and concluding with its impact on software security, while also noting related DevOps certification offerings.

SLSAprovenancesoftware supply chain
0 likes · 12 min read
Introducing SLSA: An End‑to‑End Framework for Software Supply Chain Integrity
Programmer DD
Programmer DD
Oct 7, 2023 · Information Security

Sonatype 2023 Supply Chain Report: Open‑Source Growth, Security Risks & AI

Sonatype’s 2023 software supply chain report shows a 29% average year‑over‑year growth in open‑source projects across major ecosystems, a sharp slowdown in download growth, a doubling of malicious packages, and a rapid rise in AI/ML tool adoption among DevOps and SecOps teams.

AI adoptionDevOpsopen source security
0 likes · 5 min read
Sonatype 2023 Supply Chain Report: Open‑Source Growth, Security Risks & AI
Sohu Tech Products
Sohu Tech Products
Aug 9, 2023 · Information Security

Software Supply Chain Security: Risks, Attacks, and Mitigation

The article explains software supply chain security across development, delivery, and usage phases, outlines ten common vulnerabilities and four attack categories, describes attack characteristics, examines risk factors in design, code, release, and operation stages, and presents comprehensive mitigation measures including SDL phases, DevSecOps practices, and detailed lifecycle controls.

DevSecOpsSDLSecurity
0 likes · 12 min read
Software Supply Chain Security: Risks, Attacks, and Mitigation
Cloud Native Technology Community
Cloud Native Technology Community
Aug 8, 2023 · Cloud Native

Securing Cloud‑Native Applications: A Full‑Lifecycle Guide

This whitepaper explains how the shift to cloud‑native development reshapes security, analyzes the challenges of moving from perimeter‑based models to label‑driven protection, and offers practical recommendations for embedding security across development, distribution, deployment, and runtime stages.

SecurityZero Trustsoftware supply chain
0 likes · 8 min read
Securing Cloud‑Native Applications: A Full‑Lifecycle Guide
Liangxu Linux
Liangxu Linux
Jun 20, 2023 · Information Security

How AI Hallucinations Fuel Fake NPM Package Attacks and What You Can Do

The article explains how ChatGPT's hallucinations can generate non‑existent package links that attackers register and weaponize, demonstrates the attack with a fake Node.js npm package, and offers practical steps to detect and prevent such supply‑chain threats.

AI securityChatGPT hallucinationfake npm packages
0 likes · 5 min read
How AI Hallucinations Fuel Fake NPM Package Attacks and What You Can Do
Efficient Ops
Efficient Ops
Mar 29, 2023 · Information Security

Securing the Software Supply Chain in Agile Development

This article examines the rising software supply‑chain security risks in fast‑paced agile development, outlines regulatory pressures, and presents a comprehensive management framework—including policies, dynamic asset views, full‑lifecycle risk identification, and DevSecOps practices—to help enterprises mitigate vulnerabilities and ensure secure delivery.

Agile DevelopmentDevSecOpssoftware supply chain
0 likes · 8 min read
Securing the Software Supply Chain in Agile Development
Programmer DD
Programmer DD
Mar 12, 2023 · Information Security

GitHub’s 2FA Mandate: Boosting Software Supply Chain Security

Starting March 13, 2023, GitHub will enforce two‑factor authentication for all contributors, rolling out the requirement gradually based on activity and project impact, to strengthen the global software supply chain against account takeover attacks and align with broader cybersecurity policies.

Developer SecurityGitHubTwo-Factor Authentication
0 likes · 6 min read
GitHub’s 2FA Mandate: Boosting Software Supply Chain Security
MaGe Linux Operations
MaGe Linux Operations
Oct 28, 2022 · Information Security

Hidden Malware in Fake GitHub PoCs: Researchers Find 4,893 Malicious Repos

Researchers from the Leiden Institute of Advanced Computer Science analyzed over 47,000 GitHub repositories, uncovering that many fake proof‑of‑concept exploits conceal malware, with nearly 5,000 repositories deemed malicious and detailed case studies revealing hidden trojans, Cobalt Strike tools, and stealthy information stealers.

GitHubThreat analysismalware
0 likes · 6 min read
Hidden Malware in Fake GitHub PoCs: Researchers Find 4,893 Malicious Repos
DevOps
DevOps
Oct 11, 2022 · Operations

Key Findings from the 2022 Accelerate State of DevOps Report: Security, Software Supply Chain, and Cloud Adoption

The 2022 Accelerate State of DevOps Report reveals that while application‑level security scanning in CI/CD pipelines is widely adopted, organizational culture, cloud adoption, and performance metrics significantly influence DevOps effectiveness, with overall performance declining amid pandemic‑related challenges.

DORA reportDevOpsSecurity
0 likes · 6 min read
Key Findings from the 2022 Accelerate State of DevOps Report: Security, Software Supply Chain, and Cloud Adoption
DevOps Cloud Academy
DevOps Cloud Academy
Sep 27, 2022 · Information Security

Securing Version Control Systems and CI/CD Pipelines in the Software Supply Chain

The article explains how vulnerabilities in version control systems and CI/CD pipelines can expose the software supply chain to attacks and provides best‑practice recommendations for hardening VCS configurations, branch protection, least‑privilege access, secure testing environments, and credential management.

CI/CD securityVCS securityinformation security
0 likes · 9 min read
Securing Version Control Systems and CI/CD Pipelines in the Software Supply Chain
Programmer DD
Programmer DD
Aug 9, 2022 · Information Security

What Is the “Fat Tiger Effect” and How It Shapes Open‑Source Trust

The article explains the “Fat Tiger effect”—how a single good or bad action by an open‑source project or its maintainer can dramatically swing community perception, illustrated with cases like Microsoft’s shift, Qt’s licensing change, and recent npm supply‑chain attacks, and offers a balanced view on evaluating open‑source software.

community dynamicsopen sourceopen source governance
0 likes · 11 min read
What Is the “Fat Tiger Effect” and How It Shapes Open‑Source Trust
DevOps Cloud Academy
DevOps Cloud Academy
Apr 19, 2022 · Fundamentals

Fifteen Guidelines for a Healthy Software Supply‑Chain Dependency Management (Part 2)

This article presents a comprehensive set of fifteen best‑practice guidelines—nine pre‑inclusion checks and six post‑inclusion usage rules—covering design review, code quality, automated testing, debugging, licensing, transitive dependencies, security, and upgrade strategies to ensure a robust and secure software supply chain.

dependency managementopen sourcesoftware supply chain
0 likes · 19 min read
Fifteen Guidelines for a Healthy Software Supply‑Chain Dependency Management (Part 2)
Programmer DD
Programmer DD
Feb 23, 2022 · Information Security

Navicat Premium Compromised: Detect the Threat and Choose Safer Database Tools

A recent threat intelligence report reveals that Navicat Premium has been poisoned via a cracked version distributed from www.macwk.com, prompting users to urgently check for infections, change database passwords, and consider safer alternatives like Sequel Pro or IntelliJ IDEA's built‑in database client.

Alternative ToolsDatabase ToolsNavicat
0 likes · 5 min read
Navicat Premium Compromised: Detect the Threat and Choose Safer Database Tools
Cloud Native Technology Community
Cloud Native Technology Community
Dec 1, 2020 · Information Security

Cloud Native Security Whitepaper – A Comprehensive Guide to Securing Cloud‑Native Development, Deployment, and Operations

This whitepaper provides a detailed, end‑to‑end framework for organizations and technical leaders to understand, implement, and continuously improve security across the cloud‑native lifecycle—covering development, release, deployment, runtime, supply‑chain protection, zero‑trust architecture, and compliance—while emphasizing automation, observability, and cross‑functional collaboration.

ContainerDevSecOpsSecurity
0 likes · 58 min read
Cloud Native Security Whitepaper – A Comprehensive Guide to Securing Cloud‑Native Development, Deployment, and Operations