Polyfill supply chain attack hits 100K+ sites
by Sansec Forensics Team Published in Threat Research − June 25, 2024 The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites. Update June 28th: We are flagging more domains that have been used by the same actor to spread malware since at least June 2023: bootcdn.net, bootcss.com, staticfile.net, staticfile.org, unionadjs.com, xhsbpza.com, union.m
ClassPad.net不正アクセスによる 個人情報漏えいの経緯と対策状況について | ClassPad.net
Node.js — Thursday February 16 2023 Security Releases
(Update 16-February-2023) Security releases available Updates are now available for the v19.x, v18.x, v16.x, and v14.x Node.js release lines for the following issues. OpenSSL Security updates This security release includes OpenSSL security updates as outlined in the recent OpenSSL security advisory. Impacts: All versions of the 19.x, 18.x, 16.x, and 14.x release lines. Node.js Permissions policies
ケフィアグループの破産は28社、元代表2名も個人破産 ： 東京商工リサーチ
日本経済の「現在」を理解するための手がかりとして、TSRが長年蓄積してきた企業情報、倒産情報および公開情報等に基づき、独自の視点に立った分析をまとめて発表しています。
CircleCI security alert: Rotate any secrets stored in CircleCI (Updated Jan 13)
CircleCI News Last Updated Mar 13, 2023 14 min read Security update 01/12/2023 - 00:30 UTC We have partnered with AWS to help notify all CircleCI customers whose AWS tokens may have been impacted as part of this security incident. Today, AWS began alerting customers via email with lists of potentially impacted tokens. The subject line for this email is [Action Required] CircleCI Security Alert to
npm security update: Attack campaign using stolen OAuth tokens
Securitynpm security update: Attack campaign using stolen OAuth tokensnpm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings. As of June 2, 2022, GitHub has completed directly notifying all impacted users for whom we were able to detect abuse from the attack on npm. If you have not received a notification directly from GitHub, we do not have evidence that yo
GitHub Advisory Database now powers npm audit
ProductSecurityGitHub Advisory Database now powers npm auditToday, we’re adding a proxy on top of the GitHub Advisory Database that speaks the `npm audit` protocol. This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory Database. Supply chain security is one of the most important parts of software development today, and we want to
The npm registry is deprecating TLS 1.0 and TLS 1.1
ProductThe npm registry is deprecating TLS 1.0 and TLS 1.1Beginning October 4, 2021, all connections to npm websites and the npm registry, including for package installation, must use TLS 1.2 or higher. Beginning October 4, 2021, all connections to npm websites and the npm registry—including for package installation—must use TLS 1.2 or higher. GitHub is committed to ensuring the security of our se
私のセキュリティ情報収集法を整理してみた（2021年版） - Fox on Security
Resuming SameSite Cookie Changes in July
$200K 1 10th birthday 4 abusive ads 1 abusive notifications 2 accessibility 3 ad blockers 1 ad blocking 2 advanced capabilities 1 android 2 anti abuse 1 anti-deception 1 background periodic sync 1 badging 1 benchmarks 1 beta 83 better ads standards 1 billing 1 birthday 4 blink 2 browser 2 browser interoperability 1 bundles 1 capabilities 6 capable web 1 cds 1 cds18 2 cds2018 1 chrome 35 chrome 81
Temporarily rolling back SameSite Cookie Changes
$200K 1 10th birthday 4 abusive ads 1 abusive notifications 2 accessibility 3 ad blockers 1 ad blocking 2 advanced capabilities 1 android 2 anti abuse 1 anti-deception 1 background periodic sync 1 badging 1 benchmarks 1 beta 83 better ads standards 1 billing 1 birthday 4 blink 2 browser 2 browser interoperability 1 bundles 1 capabilities 6 capable web 1 cds 1 cds18 2 cds2018 1 chrome 35 chrome 81
Yarn support for security alerts
Open SourceProductSecurityYarn support for security alertsYarn now supports security alerts for public and private repositories. GitHub security alerts help developers stay on top of vulnerabilities that impact their dependencies. JavaScript developers already receive alerts for their NPM-based projects that use package.json and package-lock.json manifests. Now developers who use Yarn for dependen
Secure Contexts Everywhere – Mozilla Security Blog
Since Let’s Encrypt launched, secure contexts have become much more mature. We have witnessed the successful restriction of existing, as well as new features to secure contexts. The W3C TAG is about to drastically raise the bar to ship features on insecure contexts. All the building blocks are now in place to quicken the adoption of HTTPS and secure contexts, and follow through on our intent to de
npm Blog Archive: New Package Moniker rules
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. We’ve recently made some changes to how package naming works to better fight typosquatting, and help package authors pick names that stand out. You might have read our post earlier about typosquatting on the npm registry. We responded to this incident with some internal tool
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
An update on Chrome Security updates – shipping security fixes to you faster
Discontinued · Issue #533 · patriksimek/vm2
重要なお知らせ｜クレジットカードはUCカード
Security issue: compromised npm packages of ua-parser-js (0.7.29, 0.8.0, 1.0.0) - Questions about deprecated npm package ua-parser-js · Issue #536 · faisalman/ua-parser-js
https://bugs.chromium.org/p/chromium/issues/detail?id=1065085
Sign in - Google Accounts