Phylum Research | Software Supply Chain Security (Page 26)

Build System and Version Control Compromises - the New Normal

Phylum Insights and Resources

While SolarWinds made headlines within the last few months for the sheer scope of impact, a sharp uptick in build and version control system compromises have followed in the intervening months, targeting third-party tools and open

Phylum Research Team Apr 25, 2021 3 min read

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

SCA or public databases

82%

of Phylum’s findings are not found by
SCA or reported to public databases

Other curation tools

70%

of Phylum’s findings are not found by
other curation tools

Other software supply chain companies

60%

of Phylum’s findings are not found by
other software supply chain companies

What the History of Software Supply Chain Attacks Says About Today’s Risk

Despite attracting major media attention in the wake of the recent SolarWinds breach, software supply chain attacks are not a new concept. In this post,...

Phylum Research Team Apr 21, 2021 5 min read

Internally Hosted Dependencies: A Losing Battle

There are well-known issues and uncertainties that come with third-party dependencies such as stale libraries containing vulnerabilities, malicious authors, and poorly-vetted contributions. As a result,...

Phylum Research Team Mar 23, 2021 3 min read

Repo Jacking: Hidden Danger in Broken Links

When contemplating the dangers of 3rd party libraries, there are a lot of things you can't control. While issues related to direct contribution...

Phylum Research Team Mar 17, 2021 4 min read

How to Understand and Defend Against SolarWinds-Type Attacks

In late 2020, one of the most devastating cyber attacks of the last decade was discovered: the SolarWinds breach. It was a notable event for...

Phylum Research Team Jan 9, 2021 6 min read

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

Subscribe to our research