Reverse Engineer at ReversingLabs
A Visual Studio Code Extensions Marketplace flaw highlights the risk potential. Here's how the VS Code IDE can proliferate to npm.
Read More about VS Code hack shows how supply chain attacks can extend to other software development tools
A malicious Python file found on the PyPI repository adds backdoor and data exfiltration features to what appears to be a legitimate SDK client from SentinelOne.
Read More about SentinelSneak: Malicious PyPI module poses as security software development kit
Days after researchers for Phylum and Checkmarx revealed an ongoing software supply chain attack spreading the W4SP Stealer malware through malicious packages on the Python Package Index (PyPI), ReversingLabs researchers discovered 10 additional PyPI packages pushing modified versions of W4SP that were overlooked.
Read More about W4SP continues to nest in PyPI: Same supply chain attack, different distribution method
ReversingLabs has discovered a malicious npm package disguised as the software tool Material Tailwind. Here's an in-depth look at our discovery — and threat analysis.
Read More about Threat analysis: Malicious npm package mimics Material Tailwind CSS tool
After a recent discovery of malicious PyPI packages, questions remain about the security community’s ability to mitigate threats posed to open source repositories.
Read More about New malicious packages in PyPI: What it means for securing open source repositories
ReversingLabs researchers have uncovered a widespread campaign to install malicious npm modules that are harvesting sensitive data from forms embedded in mobile apps and websites.
Read More about Update: IconBurst npm software supply chain attack grabs data from apps and websites
The growing number of software supply chain attacks is putting pressure on validation of software integrity and authenticity.
Read More about Go below the surface on tampering: The trouble with software integrity validation
Python packages can contain sensitive information. Here's how software development teams can keep secrets secret
Read More about It’s not a secret if you publish it on PyPI
Package repository content can be different from source code repository content. Here's what your software team needs to know.
Read More about Coinminer and npm: What you see is not always what you get