Phylum

Phylum automates software supply chain security to contextualize risks, block attacks and allow organizations to only use trusted open-source code.

[Phylum @Phylum_IO]

📢 Breaking news: We’re beyond excited to announce that our malicious package analysis, detection, and mitigation technology has been acquired by @Veracode! Together, we’ll take software supply chain security to the next level. Read more below:

https://t.co/MvoT1ikKlN

[Phylum @Phylum_IO]

Phylum Exclusive Research Report by #CEO, Aaron Bray ⚔️ 2025 Software Supply Chain Security Trends & Predictions: AI, Shadow Application Development and Nation-State Attacks - https://t.co/bj6BGDs1i1

#phylumresearch #softwaresupplychainsecurity #2025trends #CEOinsights

[Phylum @Phylum_IO]

"In Q3 2024, Phylum identified 465,897 malicious packages in the software supply chain open source ecosystem." Read the latest Evolution of Software Supply Chain Security Report via the Phylum Research Team - https://t.co/uKk9SjsdKY [7 min read]
#DevOps #CISO #opensourceecosystem

[Phylum @Phylum_IO]

Q3 2024 Evolution of Software Supply Chain Security Report via the Phylum Research Team - https://t.co/uKk9SjsLAw

#malciouspackages #npm #opensourceecosystem #DevOps #CISO #AppSec #acceptableuse #softwaresupplychainsecurity #CybersecurityAwarenessMonth #CyberSecurity

[Phylum @Phylum_IO]

🎃 Trick or treat? #Malware authors opted for the former with a series of malicious #npm packages targeting #Puppeteer users in an ongoing #typosquat campaign!

https://t.co/OP3d1v6jw6

#nodejs #npm #ethereum #opensource #javascript #cryptocurrency #cybersecurity #infosec

[Phylum @Phylum_IO]

Subscribe to Phylum Research ⚔️ New Report Coming Soon 🔔 https://t.co/gDWUBbSCeq

#opensource #techcommunity #opensourceecosystem #softwaresupplychain #devops #CISO #AppSec #acceptableuse #techcommunity #developercommunity

[Phylum @Phylum_IO]

Have you ever had your private #crypto keys stolen? #Malware authors have published forks of the popular Ethers library that exfiltrate private keys & give attackers #SSH access to infected machines.

https://t.co/kHS1q6DqYH

#npm #opensource #security #ethereum #cryptocurrency

[Phylum @Phylum_IO]

@__grunet @SocketSecurity @nuget We’ve got support for dotnet and Nuget already, and have written a few research blogs on findings in those ecosystems!

[Phylum @Phylum_IO]

Phylum For Artifact Repositories and Package Managers
https://t.co/pGWLveupMk

#opensource #techcommunity #opensourceecosystem #softwaresupplychain #DevOps #CISO #AppSec #acceptableuse #machinelearning #techcommunity #developercommunity

[Phylum @Phylum_IO]

@42mayfly

[Phylum @Phylum_IO]

🇰🇵☠️ Multiple #NorthKorean state actors continue running #malware campaigns against #npm #developers, stealing credentials and financial assets.

https://t.co/WjzUlRDAoo

#dprk #moonsleet #contagiousinterview #CyberSecurity #javascript #opensource

[Phylum @Phylum_IO]

@t3dotgg We loved the video ♥️

[Phylum @Phylum_IO]

@utollwi @ElisityInc @fastly @NetSPI @Bugcrowd @cyera_io @LastPass @InvictiSecurity @Mend_io @penterasec @Cymulateltd @jfrog @contrastsec @sonatype @torq_io @EFF @traceableai @ZeroFox 🐦🕶️

[Phylum @Phylum_IO]

@ianbishop2021 Thanks for the heads up! Reviewed on our side, and it seems to be resolving properly! We'll keep an eye on it 👍

[Phylum @Phylum_IO]

In the last 6 months, roughly 70% of new #npm packages were #spam. What does this mean for supply chain security?

At Black Hat USA? Find us in Startup City booth SC203!

#npmjs #node #javascript #typescript #infosec #opensource

https://t.co/rKbWsiQrXC

[Ars Technica @arstechnica]

Code sneaked into fake AWS downloaded hundreds of times backdoored dev devices https://t.co/YVcztbQMaa

[Phylum @Phylum_IO]

We've uncovered #malware hidden in a Microsoft logo JPG, shipping as fake #AWS packages on #npm! 😲

https://t.co/BCm2vgbiKJ

#steganography #opensource #cybersecurity #npmjs #javascript #typescript #SoftwareDevelopment #informationsecurity

[Phylum @Phylum_IO]

Advanced threat actors have not let up on their attacks against the software supply chain. We catalog recent attacks from North Korean state actors in our new blog post!

#npm #javascript #typescript #malware #cybersecurity #npmjs

https://t.co/nawJmpwr7o

[Phylum @Phylum_IO]

@nh0x01 Technically speaking, jsdelivr will auto-convert any Github link into a resource it serves. So, as long as it's on GH, any CDN resources should be valid. With that said, we've tried to find instances of resources in our write-up that are being used, and they seem to be gone!

[Phylum @Phylum_IO]

Supply chain attacks come in all shapes and sizes. Today Phylum Research discusses its discovery of malicious #jQuery files in #npm.

https://t.co/BJeH8ScTB0

#javascript #opensource #sbom #js #npmjs #node #CyberSecurity