BestHub
Sign in
Tagged articles
13 articles
Page 1 of 1
Black & White Path
Black & White Path
May 18, 2026 · Information Security

Why npm Keeps Getting Compromised: A Deep Dive into the Latest node‑ipc Supply‑Chain Attack

On May 14, 2026 three malicious versions of the node‑ipc package were published to npm, injecting obfuscated payloads that steal cloud credentials, SSH keys, AI tool configurations and other sensitive files, and the article analyses the attack stages, historical repeats, npm's structural flaws, and concrete blue‑team mitigation steps.

credential theftdetection rulesnode-ipc
0 likes · 12 min read
Why npm Keeps Getting Compromised: A Deep Dive into the Latest node‑ipc Supply‑Chain Attack
Alibaba Cloud Native
Alibaba Cloud Native
Mar 26, 2026 · Information Security

How to Defend Against PyPI and Docker Hub Supply‑Chain Attacks with Cloud‑Native API Gateways

The article analyzes recent supply‑chain poisoning of the LiteLLM PyPI package and Docker Hub images, explains why PyPI is an attractive attack vector, and details a three‑layer defense using Alibaba Cloud's cloud‑native API Gateway—including KMS‑encrypted credentials, WAF traffic filtering, and Wasm sandbox plugins—to protect the software supply chain.

KMSPyPI poisoningWAF
0 likes · 11 min read
How to Defend Against PyPI and Docker Hub Supply‑Chain Attacks with Cloud‑Native API Gateways
Black & White Path
Black & White Path
Feb 9, 2026 · Information Security

Is Traditional Perimeter Defense Dead? 93% of Enterprises Expose Attack Surface via Third‑Party Services

According to SoSafe’s 2025 cybercrime trend report, 93% of organizations rely on third‑party services, 83% have experienced incidents from personal devices, and 95% see a surge in multi‑channel attacks, prompting a shift from perimeter defenses to rigorous supply‑chain scrutiny, BYOD overhaul, and proactive threat‑culture measures.

AI phishingBYODinformation security
0 likes · 8 min read
Is Traditional Perimeter Defense Dead? 93% of Enterprises Expose Attack Surface via Third‑Party Services
21CTO
21CTO
Sep 24, 2025 · Information Security

How GitHub’s New npm Security Measures Aim to Stop Supply‑Chain Worms

GitHub is tightening npm security by removing infected packages, enforcing two‑factor authentication for publishing, shortening token lifespans, and expanding trusted publishing to curb the Shai‑Hulud worm and protect the open‑source supply chain.

GitHubSoftware SecurityTwo-Factor Authentication
0 likes · 3 min read
How GitHub’s New npm Security Measures Aim to Stop Supply‑Chain Worms
21CTO
21CTO
Jun 7, 2025 · Backend Development

How the Linux Foundation’s FAIR Package Manager Aims to Stabilize WordPress

The Linux Foundation introduced the FAIR package manager to provide a neutral, decentralized way of distributing WordPress plugins and updates, aiming to reduce central‑control risks, improve supply‑chain security, and restore stability to the WordPress ecosystem.

Linux FoundationWordPresspackage manager
0 likes · 7 min read
How the Linux Foundation’s FAIR Package Manager Aims to Stabilize WordPress
Architects' Tech Alliance
Architects' Tech Alliance
Jun 16, 2022 · Information Security

Host Security Capability Construction Guide: Key Capabilities, Industry Priorities, and Implementation Process

The Host Security Capability Construction Guide analyzes evolving threats, categorizes security capabilities into basic, enhanced, and advanced levels, details industry-specific priority requirements, and outlines a comprehensive construction and evaluation process to help enterprises select appropriate solutions and build an effective host security framework.

Host Securityasset inventorycompliance
0 likes · 12 min read
Host Security Capability Construction Guide: Key Capabilities, Industry Priorities, and Implementation Process
Meituan Technology Team
Meituan Technology Team
May 26, 2022 · Information Security

Building and Deploying Software Composition Analysis (SCA) for Enterprise Security

The article analyzes the rising threat of open‑source components, explains Software Composition Analysis (SCA) and SBOM generation, outlines the three‑stage process for building an in‑house SCA capability, discusses practical challenges such as data quality and integration, and looks ahead to future standards and open‑source tools.

DevSecOpsNLPSBOM
0 likes · 37 min read
Building and Deploying Software Composition Analysis (SCA) for Enterprise Security
IT Services Circle
IT Services Circle
Mar 17, 2022 · Information Security

Malicious npm Packages: The “peacenotwar” Incident and Its Impact on the Frontend Ecosystem

The article exposes a malicious npm package called peacenotwar, injected by a politically motivated author into the node‑ipc dependency of vue‑cli, which creates a hostile file on users in Russia and Belarus, prompting npm to block the package and highlighting the fragility of the frontend supply chain.

Frontend Ecosystemmalicious codenode-ipc
0 likes · 5 min read
Malicious npm Packages: The “peacenotwar” Incident and Its Impact on the Frontend Ecosystem
ITPUB
ITPUB
Feb 15, 2021 · Information Security

How Hackers Exploit Dependency Confusion to Breach Major Tech Companies

This article explains how simple yet powerful dependency‑confusion attacks let attackers upload malicious packages to public registries, exfiltrate data via DNS, and compromise internal systems of companies like PayPal, Shopify, Apple and others, highlighting the methodology, results, root causes and mitigation ideas.

Bug Bountydependency confusionnpm
0 likes · 13 min read
How Hackers Exploit Dependency Confusion to Breach Major Tech Companies