Sonatype Firewall
“Sonatype Firewall blocks malicious code and packages before they enter your software supply chain. Protect your repositories and builds.”
Blocks malicious and policy-violating open-source components at download.
Product pageSonatype
United States1 product listed
Sonatype provides intelligence & automated governance to help you build faster & safer with open source and AI. From the creators of Nexus Repository.
Our summarySoftware supply chain company and steward of Maven Central.
- Products listed
- 1
- Research stories
- 10
- Incidents and advisories
- 0
- Indicators
- 0
Sonatype in our news, month by month
ResearchIncidents and advisories
May
7
Jun
Jul
2
Aug
Sept
Oct
Products and the controls they provide
External reviews
Independent tests, peer reviews and articles about Sonatype. We link to them; we did not write or commission them, and nobody pays to appear here.
Research by Sonatype
Stories in our coverage based on what researchers at Sonatype found or reported: 10 in total.
- 24 Aug 202691 Vulnerabilities Patched in Spring Application Framework
Spring application framework releases updates patching 91 vulnerabilities, including one critical.
- 7 Aug 2026Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
Nearly 800 malicious npm packages deliver cross-platform RAT and infostealer.
- 16 Jun 2026Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages
Arch Linux suspends AUR account registrations due to a supply chain attack impacting over 1,500 packages.
- 12 Jun 2026Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
Over 400 Arch Linux AUR packages compromised to deploy infostealer and eBPF rootkit.
- 12 Jun 2026Atomic Arch Campaign Hijacks 20+ Linux AUR Packages to Deliver Malware
Atomic Arch campaign hijacks 20+ Linux AUR packages to deliver malware via ownership transfers.
- 9 Jun 2026Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks
Shai-Hulud worm infects over 100 NPM and PyPI packages with Miasma and Hades variants.
- 4 Jun 2026Lazarus Group Uses npm Brandjacking Campaign to Target Developers
Lazarus Group deploys malicious npm packages via brandjacking to target developers and steal credentials.
- 26 Mar 2026Suspected Hijacked Developer Accounts Spread npm Malware
Hijacked npm developer accounts spread credential-stealing malware packages sbx-mask and touch-adv.
Incidents and advisories
Stories where a Sonatype product had a vulnerability or was attacked, or Sonatype itself was. Useful if you run its products.
None in our coverage yet.
Vendor Watch
Run Sonatype?
Get an email when a reviewed story names Sonatype, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Is this your company, or did we get something wrong?
Tell us what to fix on this page: a product, a description, a link or a review. We check every suggestion before changing anything, and listing stays free and editorial.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.