How AI coding tools could amplify software supply-chain attacks
Bloom Security’s SlugFest research found npm’s Trusted Publishing tied trust to a repository’s name rather than its permanent ID. GitHub shipped a fix on 2 October, almost four months after the report.
Via TNW | Contributed
AI coding tools are changing how developers obtain and use software. But the growing volume of automated package installations is creating new challenges for enterprise security teams. A vulnerability uncovered by Bloom Security demonstrates how weaknesses in software publishing infrastructure can intersect with these automated workflows. It could potentially expose organizations to malicious code without requiring attackers to steal credentials.
The research, named SlugFest, identified more than 1,500 npm packages vulnerable to a publishing attack involving GitHub repository addresses. Together…
Courtesy
This story was originally published by TNW | Contributed. All rights belong to the original publisher.
Read the original on thenextweb.com ↗