Phylum Research | Software Supply Chain Security (Page 24)

Recent NPM Malware

Phylum Insights and Resources

NPM, JavaScript’s most popular package manager, has seen a rash of malware incidents over the last year. This culminated in major community-impacting breaches in the last few weeks. Let’s dig into these events and

Phylum Research Team Nov 16, 2021 8 min read

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

SCA or public databases

82%

of Phylum’s findings are not found by
SCA or reported to public databases

Other curation tools

70%

of Phylum’s findings are not found by
other curation tools

Other software supply chain companies

60%

of Phylum’s findings are not found by
other software supply chain companies

What Happens to Author Reputation When Malicious Packages are Taken Offline?

Overview There has been an unprecedented rise in malware identified throughout the open-source ecosystem. Over the last several months alone, thousands of bad packages have...

Phylum Research Team Oct 18, 2021 2 min read

Spark and Rust - How to Build Fast, Distributed and Flexible Analytics Pipelines with Side Effects

Apache Spark is a powerful piece of software that has enabled Phylum to build and run complex analytics and models over a big data lake...

Phylum Research Team Oct 7, 2021 6 min read

A Spooky Occurrence in the Open-Source Ecosystem: Hacktoberfest 2020

In this blog post, I explore a controversy that surrounds a prominent open-source software recruitment event: the 2020 edition of Hacktoberfest....

Phylum Research Team Oct 1, 2021 7 min read

Vulnerability Reporting Has Fallen Behind

There has been an explosion in new software over the past 3-10 years. The amount of new software released and the number of new software...

Phylum Research Team Sep 28, 2021 4 min read

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

Subscribe to our research