Supply-Chain Attacks Cluster: 230,000 Advisories, Five Patterns (opens in new tab)

Covers 3 stories including perplexityai/bumblebee: Read-only inventory collector for package, extension, and developer-tool metadata on macOS and Linux developer endpoints, built for fast supply-chain exposure checks.Covered by 6 sources including This Week In 4n6, lesswrong.comDiscussed on Hacker News

Pulled the full OSV mirror for npm and PyPI — 230,000+ advisories. The malicious-tagged subset clusters into five recurring patterns. None of them are clever. All of them keep working. A note on why two decades of EDR/XDR investment is structurally unable to stop the next event-stream.

Read the original article

Sign in to keep reading the full article.

Sign Up Log In

Covered in 7 articles

This Week In 4n6·

Week 22

lesswrong.com·

AI #170: Lack of Executive Order

thezvi.substack.com·

AI #170: Lack of Executive Order

Discussed on Substack

View all 7 ›