Welcome to our blog

• Software Supply Chain Security

Recent NPM Malware

NPM, JavaScript’s most popular package manager, has seen a rash of malware incidents over the last year. This culminated in major community-impacting breaches in the last few weeks. Let’s dig into...

• Software Supply Chain Security

SCA Is Dead

The Evolution of Open Source If you are familiar with the application security space, you might feel a bit confused. Many Software Composition Analysis (SCA) products exist, after all. With so many...

• Software Supply Chain Security

What Happens to Author Reputation When Malicious Packages are Taken Offline?

Overview There has been an unprecedented rise in malware identified throughout the open-source ecosystem. Over the last several months alone, thousands of bad packages have been removed from package...

• Technical

Spark and Rust - How to Build Fast, Distributed and Flexible Analytics Pipelines with Side Effects

Apache Spark is a powerful piece of software that has enabled Phylum to build and run complex analytics and models over a big data lake comprised of data from popular programming language ecosystems.

• Software Supply Chain Security

A Spooky Occurrence in the Open-Source Ecosystem: Hacktoberfest 2020

One of the things that excites me about the open-source software ecosystem is entirely outside the technical components of code and computation. Instead, as someone whose PhD was focused on behavior...

• Software Supply Chain Security

Vulnerability Reporting Has Fallen Behind

There has been an explosion in new software over the past 3-10 years. The amount of new software released and the number of new software developers entering the job market has increased dramatically....

• Product Release

Phylum Launches Ruby, Python, and new UI/UX

We recently launched a major redesign of the product and rolled out new languages, including Ruby and Python.

• Technical

What Is "Abandonware" and Is It a Security Risk?

The open-source ecosystem is vast and replete with projects at all stages of development. There are nascent projects that are just getting started and toy projects that were never really intended for...

• Technical

Design Matters: How We Created Phylum’s Risk Score for Open-Source Packages

Generating meaningful scores for open-source packages is extremely complex. Effective scoring for risk and reputation needs to incorporate disparate pieces of information while also accounting for...

• Technical

Detecting Potential Bad Actors in GitHub

The vast open-source software ecosystem contains millions of packages and tens of millions of contributing authors. This is both the strength and the weakness of open-source software: its...