open source security

Bilingual

CISA Guide Helps Fed Agencies Securely and Effectively Use Open Source Software
11 hours ago
- CISA published a new guide titled 'Open Source Software: Security Principles and Practices' for federal agencies.
- The guide provides best practices for using, assessing, contributing to, and producing OSS, as well as evaluating open source AI models.
- It aligns with Executive Orders 14144 and 14306, emphasizing the need for secure OSS management following exploits like log4shell and xz utils.
- Agencies are urged to establish a process to review and approve OSS, including principles for patching, trustworthiness evaluation, and secure engagement.
more...
North Korea-linked hackers targeted major NPM packages
3 days ago
- Amazon Threat Intelligence linked compromises of NPM packages (axios, debug, chalk, typo-crypto) to the same DPRK-linked threat actor, SAPPHIRE SLEET/STARDUST CHOLLIMA.
- Attackers are using fragment-level attacks splitting malicious workflows across multiple seemingly benign packages, long-horizon trust-building, decoupling behavior from packages, real cryptography, and sandbox evasion.
- Generative AI enables attackers to create convincing malicious packages at scale and introduces slopsquatting; it also creates new defense challenges as AI-based code reviewers become attack surfaces.
- AWS responds by sharing intelligence via OSV, updating Amazon Inspector and GuardDuty, and investing in open source security initiatives like Akrites.
more...
EU CRA and the Open Source Ecosystem: A Suggestion - Bert Hubert's writings
6 days ago
- The EU Cyber Resilience Act (CRA) aims to improve hardware and software security but has ambiguous regulations that could directly affect open source projects and foundations.
- Open source software is integral to most commercial products, yet many open source projects lack budgets for compliance, creating a risk to innovation.
- The author suggests amending the CRA to require commercial manufacturers using open source to invest in its security, possibly through industry consortia, rather than regulating open source projects directly.
- Manufacturers currently use open source components without contributing to their security; the CRA's due diligence clause could be leveraged to foster industry-funded improvements.
more...
Using OpenCode in CI/CD for AI pull request reviews
6 days ago
- OpenCode is an open-source CLI tool used in CI/CD pipelines to perform AI code reviews without granting third-party access to repositories.
- It addresses security concerns of existing AI code review SaaS tools by eliminating the need for OAuth or persistent third-party access to code repositories.
- The setup works with any YAML-based CI/CD system (e.g., GitHub Actions, GitLab CI, Bitbucket Pipelines) and involves cloning the repo, installing OpenCode, and running a prompt to analyze diffs.
- The AI review process uses a conservative prompt that focuses on critical issues (e.g., performance, security, validation) and avoids false positives by verifying concerns through code reading.
more...
Telnyx, LiteLLM and Axios: the supply chain crisis
6 days ago
- A wave of supply chain attacks targeted popular npm packages (Telnyx, LiteLLM, axios) by injecting trojans to steal sensitive data, exploiting stolen credentials from previous attacks.
- Attackers used compromised developer credentials to publish malicious versions, creating a vicious cycle of infections that amplified the reach of the attack.
- LLMs are suspected to be accelerants, making it easier to find vulnerabilities and build sophisticated exploits, such as hiding code in audio files.
- Current mitigations (short-lived tokens, package delays, staged publishing) are insufficient; they introduce delays or can be bypassed if developer machines are compromised.
more...
AI Meets Cryptography 1: What AI Found in Cloudflare's Circl
a month ago
- zkSecurity built zkao, an AI audit agent designed to continuously find bugs in code until no AI-detectable ones remain.
- An audit of Cloudflare's CIRCL library found seven real bugs, including critical issues in threshold RSA and attribute-based encryption, all now fixed.
- Bugs included: float64 precision loss, DLEQ forgery, BLS missing message distinctness, DLEQ soundness break via sign collision, HPKE PSK bypass, int64 overflow in Lagrange coefficients, and CP-ABE access-control break.
- AI severity ratings often misaligned with confirmed severity, highlighting challenges in impact assessment due to unseen downstream use.
more...

open source security

CISA Guide Helps Fed Agencies Securely and Effectively Use Open Source Software

North Korea-linked hackers targeted major NPM packages

EU CRA and the Open Source Ecosystem: A Suggestion - Bert Hubert's writings

Using OpenCode in CI/CD for AI pull request reviews

Telnyx, LiteLLM and Axios: the supply chain crisis

AI Meets Cryptography 1: What AI Found in Cloudflare's Circl