Browsing Tag
Open Source Security
13 posts
Open source software security and dependency risk
The Arch AUR Malware Attack Is a Linux Supply Chain Warning
A June 2026 Arch User Repository compromise hit hundreds of community packages with credential-stealing Linux malware. Arch and Arch-based users should treat recent AUR builds as a security event, not a routine package cleanup.
npm 12 Will Make Install Scripts Opt-In by Default
npm 12 is expected in July 2026 with stricter install defaults: dependency lifecycle scripts, Git dependencies, and remote tarballs will no longer run or resolve automatically without approval.
AI Coding Tools Are Making Package Security Harder
Microsoft’s npm findings show why AI coding agents need stricter dependency gates: install scripts, registry routing, lockfiles, CI secrets, and package provenance now sit inside the agent workflow.