AI-generated computer code is rife with references to non-existent third-party libraries, creating a golden opportunity for supply-chain attacks that poison legitimate programs with malicious packages ...

A North Korean APT has crafted malicious software packages to appeal to AI coding agents, while ‘slopsquatting’ shows the security risks of hallucinated dependencies. Attackers too are looking to cash ...

A new class of supply chain attacks named 'slopsquatting' has emerged from the increased use of generative AI tools for coding and the model's tendency to "hallucinate" non-existent package names. The ...

Modern enterprise software development increasingly relies on a vast and complex supply chain of third-party components, integrations, and frameworks. No-code development platforms are no exception, ...

A quiet compromise of a popular open-source coding editor has turned into one of the most unsettling software supply-chain stories of the year. Attackers silently hijacked the infrastructure behind ...

Sophisticated cyberattacks targeting a variety of open source projects, including the Trivy security-scanner project, the widely used Axios Javascript package, and now Anthropic's accidental ...

GUEST OPINION: Software supply chain attacks have accelerated in recent years, aiming to hit organisations’ developer environments. There have been regular instances of successful attacks, including ...