[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:software-supply-chain":3},{"control":4,"products":25,"stories":69,"lessons":113,"related":138,"compare":143},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.","Analysis of the open-source components in your software, blocking of malicious packages, software bills of materials (SBOMs) and protection of build pipelines.","Malicious npm and PyPI packages are published every day, and one poisoned dependency can reach thousands of companies. Knowing what is inside your software, and stopping bad packages at the door, is also becoming a legal duty for products sold in the EU under the Cyber Resilience Act.",[11,12,13,14],"Does it detect malicious packages, not just known vulnerabilities?","Can it block a bad package before a developer installs it?","Does it produce SBOMs in standard formats such as CycloneDX and SPDX?","How does it rank vulnerabilities that our code can actually reach?","Risk: compromised or vulnerable open-source components enter our products. Control: component analysis with malicious package blocking, and an SBOM for every release. Owner: engineering lead. Measure: releases with an SBOM, and open critical findings.",[17,18,19,20],"NIS2 Art. 21(2)(d) and (e): supply chain and secure development","EU Cyber Resilience Act Annex I: vulnerability handling and SBOM","CIS Control 16: application software security","ISO\u002FIEC 27001:2022 A.8.25 and A.8.28: secure development and coding",{"name":22,"slug":23},"Supply Chain","supply-chain","2026-10-16T12:48:27.564394+00:00",[26,34,42,47,55,61],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":43,"product_name":44,"url":45,"description":46},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":56,"product_name":57,"url":59,"description":60},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"total":70,"last_days":71,"recent":72},709,190,[73,78,83,88,93,98,103,108],{"slug":74,"title":75,"published_at":76,"brief":77},"malfex-npm-package-imgdecode-hides-shellcode-loader-in-windows-native-addon-219fd9","MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon","2026-10-17T11:11:56+00:00","Malicious npm package 'imgdecode' hides shellcode loader in Windows native addon.",{"slug":79,"title":80,"published_at":81,"brief":82},"attackers-tampered-with-aomei-backupper-s-update-servers-for-minutes-to-deliver--ffdcab","Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor","2026-10-16T16:43:39+00:00","Attackers tampered with AOMEI Backupper update servers to deliver a backdoor.",{"slug":84,"title":85,"published_at":86,"brief":87},"fake-arch-linux-packages-push-malware-with-root-privileges-bf40b1","Fake Arch Linux packages push malware with root privileges","2026-10-15T17:12:31+00:00","Malicious Arch Linux packages impersonating popular tools delivered malware with root privileges.",{"slug":89,"title":90,"published_at":91,"brief":92},"anthropic-gives-open-source-maintainers-a-fast-track-to-mythos-vulnerability-fin-fc092d","Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings","2026-10-15T14:13:04.878+00:00","Anthropic launches OSS Scanner to help open source projects find vulnerabilities faster.",{"slug":94,"title":95,"published_at":96,"brief":97},"next-js-ships-out-of-band-patch-for-two-critical-rce-flaws-in-caching-and-svg-pr-526318","Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing","2026-10-15T12:28:13+00:00","Next.js releases patch for two critical RCE flaws in caching and SVG processing.",{"slug":99,"title":100,"published_at":101,"brief":102},"pep-829-makes-python-startup-safer-but-risk-remains-e882a0","PEP 829 Makes Python Startup Safer, But Risk Remains","2026-10-15T10:01:00+00:00","Python 3.15's PEP 829 improves startup security but doesn't fully prevent malicious code execution.",{"slug":104,"title":105,"published_at":106,"brief":107},"sap-discloses-critical-cvss-10-flaw-in-cloud-sdk-for-python-allowing-oauth2-cred-9f98c6","SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft","2026-10-13T17:28:50+00:00","SAP Cloud SDK for Python has critical CVSS 10 flaw allowing OAuth2 credential theft.",{"slug":109,"title":110,"published_at":111,"brief":112},"github-tightens-npm-publishing-after-flaw-left-1-500-packages-vulnerable-to-hija-3d29c8","GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking","2026-10-13T16:18:18+00:00","GitHub expires npm trusted publishing configs after 48 hours to prevent package hijacking.",[114,118,122,126,130,134],{"slug":115,"title":116,"published_at":117},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":119,"title":120,"published_at":121},"aomei-backupper-update-servers-hijacked-to-distribute-backdoor","AOMEI Backupper Update Servers Hijacked to Distribute Backdoor","2026-10-16T18:21:08.893+00:00",{"slug":123,"title":124,"published_at":125},"ai-powered-oss-scanner-fast-tracks-vulnerability-disclosure-for-open-source-maintainers","AI-Powered OSS Scanner Fast-Tracks Vulnerability Disclosure for Open Source Maintainers","2026-10-15T20:21:23.114+00:00",{"slug":127,"title":128,"published_at":129},"malicious-aur-packages-execute-root-level-malware-via-typosquatting","Malicious AUR Packages Execute Root-Level Malware via Typosquatting","2026-10-15T18:20:20.988+00:00",{"slug":131,"title":132,"published_at":133},"pythons-new-startup-files-reduce-but-dont-eliminate-supply-chain-risk","Python's New Startup Files Reduce But Don't Eliminate Supply Chain Risk","2026-10-15T16:21:36.544+00:00",{"slug":135,"title":136,"published_at":137},"critical-rce-flaws-in-nextjs-demand-immediate-patching","Critical RCE Flaws in Next.js Demand Immediate Patching","2026-10-15T16:21:23.504+00:00",[139],{"slug":140,"name":141,"problem":142},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"socket\u002Fsocket":144,"jfrog\u002Fjfrog-xray":150,"sonatype\u002Fsonatype-firewall":162,"github\u002Fadvanced-security":175,"snyk\u002Fsnyk-open-source":189,"jfrog\u002Fjfrog-curation":199},{"hq_country":145,"also_provides":146,"reviews":147,"affected":148,"reported":149},"US",[],[],0,43,{"hq_country":151,"also_provides":152,"reviews":153,"affected":160,"reported":161},null,[],[154,157],{"label":155,"url":156},"PeerSpot: JFrog Xray user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fjfrog-xray-reviews",{"label":158,"url":159},"Gartner Peer Insights: JFrog Software Supply Chain Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fjfrog-software-supply-chain-platform",25,6,{"hq_country":145,"also_provides":163,"reviews":164,"affected":148,"reported":174},[],[165,168,171],{"label":166,"url":167},"PeerSpot: Sonatype Lifecycle user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsonatype-lifecycle-reviews",{"label":169,"url":170},"Gartner Peer Insights: Sonatype Repository Firewall user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fsonatype-repository-firewall",{"label":172,"url":173},"PeerSpot: Sonatype Repository Firewall user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsonatype-repository-firewall-reviews",2,{"hq_country":145,"also_provides":176,"reviews":180,"affected":187,"reported":188},[177],{"slug":178,"name":179},"secrets-management","Secrets management",[181,184],{"label":182,"url":183},"Gartner Peer Insights: GitHub user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fgithub-826147115",{"label":185,"url":186},"PeerSpot: GitHub Advanced Security user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fgithub-advanced-security-reviews",15,4,{"hq_country":151,"also_provides":190,"reviews":191,"affected":148,"reported":198},[],[192,195],{"label":193,"url":194},"PeerSpot: Snyk user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsnyk-reviews",{"label":196,"url":197},"Gartner Peer Insights: Snyk Open Source user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fsnyk-open-source",1,{"hq_country":151,"also_provides":200,"reviews":201,"affected":160,"reported":161},[],[202,203],{"label":155,"url":156},{"label":158,"url":159}]