OX Security

TL;DR Application Security Posture Management (ASPM) pulls results from Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and Infrastructure as Code (IaC) scanners into one view.

TeamPCP went to jail, but the spirit of Shai-Hulud lives on: @7nohe/openapi-react-query-codegen was compromised, 128k weekly downloads affected Overview Less than 24h of TeamPCP's creators arrest in Australia, a new Shai-Hulud malware variant hits npm, sp

OX Security identified and is tracking a fake Cloudflare Captcha campaign that can potentially distribute ClickFix malware through npm, and found 24 distinct malicious packages sharing the exact same malicious code. Overview The OX Research team is tracki

Watch: AI Is Reshaping Supply Chain Security TL;DR An SBOM (Software Bill of Materials) is a point-in-time inventory of the components inside a software artifact. A PBOM (Pipeline Bill of Materials) (a standard originated by OX Security) is a continuously

Two flaws in GitLab's GraphQL API: one lets any user wipe or alter public projects and user data, the other quietly runs changes using a logged-in user's own permissions. Self-managed instances from 18.2 through 19.2 need to upgrade now. Overview On Augus