‘Download pumping’ joins the trust-abuse bandwagon
While this repository vector is not new, researchers have uncovered a new twist for exploiting trusted metrics to hide malicious code.
John P. Mello Jr.
Freelance technology writer. John's work has appeared in the The Boston Globe and Boston Herald, as well as CFO, CIO, CSO, and Inc. magazines. He is a former managing editor of the Boston Business Journal and Boston Phoenix, as well as a staff writer for Government Security News.
Posts from John P. Mello Jr.
‘Download pumping’ joins the trust-abuse bandwagon
AI use in cybersecurity is on the rise — and so is burnout
The Life and Times of Cybersecurity Professionals study highlights a trend that has accelerated as cyber has become more complex.
Agentic AI risk isn't a model problem. It's an architecture problem.
Agentic AI is moving the perimeter from components to data — and most strategies aren't built for that.
Update to npm blocks install scripts: What it means for AppSec
Disabling scripts by default closes the vector worms like Shai-Hulud rely on. Here's what the update fixes — and what it doesn't.
MCP security tracks API's playbook — we know how that ends
The standard connecting AI agents to tools and data leaves security to others. Make it a do-over.
Dependency remediation bolstered with CVE Lite CLI
OWASP's new dependency scanner gives developers actionable fixes. But supply chain attacks aren’t yet CVEs.
CVE noise drowns out supply chain threats
48,000 CVEs were reported in 2025 — but just 58 were critical. A new report highlights why signal-to-noise ratio matters for AppSec.
5 lessons from vulnerability management's front lines
VM success is determined by findings reaching developers with context — which is getting more challenging. Here's why to shift gears.
GitHub breach: The development ecosystem is in the hot seat
This TeamPCP attack is a serious wakeup call about software supply chain security — and the problems with implicit trust.