AI coding tools can speed up development, but they also increase open-source dependencies and create growing remediation debt for security teams. The webinar shares findings from 300 enterprise leaders on how organizations like ActiveState are handling AI-driven open-source risk, governance, and downstream business impact. #ActiveState #RebeccaBanks #MorisChen...

Claude Code 2.1.88 leak exposed 512,000 lines via npm error, fueling supply chain risks and typosquatting attacks.

Open source end-of-life (EOL) packages are frequently omitted from CVE investigations and vulnerability feeds, leaving millions of versions unflagged and enterprises exposed. Industry research from HeroDevs and Sonatype shows 5.4M EOL package versions across major registries and finds that AI-driven discovery like Project Glasswing may increase uncovered vulnerabilities in unmaintained code. #SpringSecurity #ProjectGlasswing

North Korean-linked threat actors tracked as UNC1069 used a highly targeted social engineering campaign to steal the Axios maintainer's credentials and publish trojanized versions of the package. The compromise deployed a remote access implant called WAVESHAPER.V2 and underscores the massive supply-chain risk posed by attacks on popular open-source maintainers. #UNC1069 #WAVESHAPERV2...

GitHub says the hackers who breached 3,800 internal repositories gained access via a malicious version of the Nx Console VS Code extension, compromised in last week's TanStack npm supply-chain attack.