The EU Cyber Resilience Act (CRA) aims to improve hardware and software security but has ambiguous regulations that could directly affect open source projects and foundations.
Open source software is integral to most commercial products, yet many open source projects lack budgets for compliance, creating a risk to innovation.
The author suggests amending the CRA to require commercial manufacturers using open source to invest in its security, possibly through industry consortia, rather than regulating open source projects directly.
Manufacturers currently use open source components without contributing to their security; the CRA's due diligence clause could be leveraged to foster industry-funded improvements.
OpenCode is an open-source CLI tool used in CI/CD pipelines to perform AI code reviews without granting third-party access to repositories.
It addresses security concerns of existing AI code review SaaS tools by eliminating the need for OAuth or persistent third-party access to code repositories.
The setup works with any YAML-based CI/CD system (e.g., GitHub Actions, GitLab CI, Bitbucket Pipelines) and involves cloning the repo, installing OpenCode, and running a prompt to analyze diffs.
The AI review process uses a conservative prompt that focuses on critical issues (e.g., performance, security, validation) and avoids false positives by verifying concerns through code reading.
A wave of supply chain attacks targeted popular npm packages (Telnyx, LiteLLM, axios) by injecting trojans to steal sensitive data, exploiting stolen credentials from previous attacks.
Attackers used compromised developer credentials to publish malicious versions, creating a vicious cycle of infections that amplified the reach of the attack.
LLMs are suspected to be accelerants, making it easier to find vulnerabilities and build sophisticated exploits, such as hiding code in audio files.
Current mitigations (short-lived tokens, package delays, staged publishing) are insufficient; they introduce delays or can be bypassed if developer machines are compromised.