Phylum Research | Software Supply Chain Security (Page 14)

Phylum Detects Suspicious Publications Surrounding Popular Python Package Flask

Phylum Research

On the morning of May 10, 2023, Phylum’s automated risk detection platform flagged a series of publications surrounding the popular Flask package on PyPI. After reaching out to the author, we discovered that they were

Phylum Research Team May 12, 2023 9 min read

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

SCA or public databases

82%

of Phylum’s findings are not found by
SCA or reported to public databases

Other curation tools

70%

of Phylum’s findings are not found by
other curation tools

Other software supply chain companies

60%

of Phylum’s findings are not found by
other software supply chain companies

Phylum Discovers Mischievous NPM Publications

That’s right, we’re not talking about a malicious discovery today, but rather a mischievous one. Phylum’s automated risk detection platform alerted us...

Phylum Research Team May 2, 2023 4 min read

Bad Beat Poetry

Lockfiles are great. They can also be hard to review and a source of malicious code injection....

Charles Coggins Apr 30, 2023 13 min read

Q1 2023 Evolution of Software Supply Chain Security Report

Software supply chains are unique among the broader supply chain family. Logistics-based supply chain risks can be contained or limited by industry or region. However,...

Phylum Research Team Apr 25, 2023 10 min read

Attackers Repurposing existing Python-based Malware for Distribution on NPM

On April 16, 2023, Phylum's automated risk detection platform detected a surge of publications of a library called vibranced ⚠️ Check Package on NPM. In this article, we will examine the actions taken by the attackers and their attempts to distribute Python-based malware on NPM....

Phylum Research Team Apr 19, 2023 8 min read

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

Subscribe to our research