CIRCLE WITH A DOT

Malicious NuGet packages targeted Chinese .NET developers.• ~65K downloads• Infostealer payloads• CI/CD systems at riskhttps://www.technadu.com/malicious-nuget-packages-target-chinese-net-ecosystem-developers/627373/How are you validating dependencies?#InfoSec #DevSecOps #CyberSecurity

Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Scope https://www.stepsecurity.io/blog/shai-hulud-worm-pivots-to-multi-cloud-intercom-client-hijacked#Security #SupplyChain #DevSecOps

A Mini Shai-Hulud Has Appeared: Obfuscated Bun Runtime Payloads Hit SAP-Related npm Packages https://www.stepsecurity.io/blog/a-mini-shai-hulud-has-appeared#Security #SupplyChain #DevSecOps

Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools https://www.stepsecurity.io/blog/bitwarden-cli-hijacked-on-npm-bun-staged-credential-stealer-targets-developers-github-actions-and-ai-tools#Security #SupplyChain #DevSecOps

CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister https://www.stepsecurity.io/blog/pgserve-compromised-on-npm-malicious-versions-harvest-credentials#Security #SupplyChain #DevSecOps

Announcing Dependabot Configuration Enhancements: Cooldown and Group Support https://www.stepsecurity.io/blog/announcing-dependabot-configuration-enhancements-cooldown-and-group-support#Security #SupplyChain #DevSecOps

lightning: Obfuscated JavaScript Credential Stealer Bundled in PyPI Wheel https://www.stepsecurity.io/blog/lightning-obfuscated-javascript-credential-stealer-bundled-in-pypi-wheel#Security #SupplyChain #DevSecOps

elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection https://www.stepsecurity.io/blog/elementary-data-compromised-on-pypi-and-ghcr-forged-release-pushed-via-github-actions-script-injection#Security #SupplyChain #DevSecOps

TeamPCP Injects Two-Stage Credential Stealer into xinference PyPI Package https://www.stepsecurity.io/blog/teampcp-injects-two-stage-credential-stealer-into-xinference-pypi-package#Security #SupplyChain #DevSecOps

Your MCP server might be the weakest link—here's the data. @josh.bressers.name scanned 161 MCP images and found 9,000 vulns / 263 criticals. Read the breakdown and fixes: https://anchore.com/blog/analyzing-the-top-mcp-docker-containers/#MCP #SoftwareSupplyChain #ContainerSecurity #DevSecOps

Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools https://www.stepsecurity.io/blog/bitwarden-cli-hijacked-on-npm-bun-staged-credential-stealer-targets-developers-github-actions-and-ai-tools#Security #SupplyChain #DevSecOps

TeamPCP Injects Two-Stage Credential Stealer into xinference PyPI Package https://www.stepsecurity.io/blog/teampcp-injects-two-stage-credential-stealer-into-xinference-pypi-package#Security #SupplyChain #DevSecOps

Don't let compliance checks hold up your delivery pipeline. Automate your go/no-go decisions! Read Anchore Solutions Architect Chadd Owen's latest post on securing the DoD software factory and automating required gates: https://anchore.com/blog/anchore-enterprise-and-the-dod-devsecops-reference-design/ #DevSecOps #ContainerSecurity

TeamPCP Injects Two-Stage Credential Stealer into xinference PyPI Package https://www.stepsecurity.io/blog/teampcp-injects-two-stage-credential-stealer-into-xinference-pypi-package#Security #SupplyChain #DevSecOps

"Bring Your Own SBOM" sounds simple...Until you try to manage thousands of them Scale is everything https://anchore.com/platform/sbom/#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

We just launched our new SBOM Learning Hub, a library of resources for your dev and sec teams: SBOM 101 & formats Automating CI/CD integration Tackling data sprawl Surviving EU CRA & SSDFBookmark the hub https://go.anchore.com/introduction-to-sboms.html?utm_source=sbom-campaign&utm_medium=social&utm_campaign=2026-04 #DevSecOps

The security implications of "Tokenmaxxing" cannot be ignored. As code churn increases by 800%+, the window for technical debt - and potential vulnerabilities - widens. If 10-30% of AI code is being rewritten within weeks, what does that say about the initial security audit of that code?Source: https://techcrunch.com/2026/04/17/tokenmaxxing-is-making-developers-less-productive-than-they-think/Are you seeing more insecure patterns creeping into codebases via AI agents? Let’s discuss the risk-to-reward ratio of AI-accelerated development. Follow us for more technical analysis of the AI landscape.#InfoSec #AppSec #CyberSecurity #SecureCoding #DevSecOps #Technadu

False positives killing your team's productivity? ‍Anchore Secure gives you signal, not noise https://anchore.com/platform/secure/#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

@sanityinc I wonder if the emergence of The Internet had a similar effect.

Big News, OWASP Community! The Global #AppSec USA CFP is OPEN! Got insights or real-world stories? Take the stage in San Francisco and inspire the AppSec community. https://sessionize.com/owasp-global-appsec-us-2026-cfp-SF/#Cybersecurity #DevSecOps #Infosec #opensource #community #conference