In November 2019, leading global investment firm Vista Equity Partners (Vista) acquired Sonatype, a pioneer of software supply chain management for the enterprise. This partnership is an opportunity ...
Throughout 2025, Sonatype identified more than 454,600 new malicious packages, bringing the cumulative total of known and blocked malware to over 1.233 million packages across npm, PyPI, Maven Central ...
On November 3, 2026 attackers published runtime loaders in 12 releases across 10 hijacked npm packages. Some of the packages had gone years without an update. Sonatype Research Labs links the activity ...
A new vulnerability disclosure can set off a familiar chain of work. You check whether or not an application uses the affected component, determine whether the ...
When a development team adds a dependency, it is placing trust in more than a file. The team expects the component to be what its coordinates say it is, the metadata to help its build tool resolve the ...
Most agencies and contractors now have a generative AI (GenAI) policy. Far fewer can tell you what their people are actually running. That gap has a name. Like shadow information technology before it, ...
Accelerate your DevOps pipelines and enterprise artifact management. Download Sonatype Nexus Repository for free and get started today. When you're ready to upgrade to Pro, we can migrate your ...
Sonatype is proud to be recognized as a Leader in The Forrester Wave™: SCA Software 2024. Forrester evaluated 10 top providers and named Sonatype a Leader among them. To us, this underscores our ...
Join Brian Fox, CTO at Sonatype, and Scott Vigil, Chief Software Officer at AFMC’s 309th Software Engineering Group, for a discussion about what recent AI security developments mean for federal ...
Milestone: Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale: Sonatype Research Labs logged 149,329 open source malware ...
Sonatype has identified multiple npm cryptocurrency packages, the latest versions of which have been hijacked and altered to steal sensitive information, such as environment variables, from the target ...
Today, we've observed a software supply chain attack targeting npm maintainers' publishing credentials, followed by the rapid release of new versions carrying malicious payloads. To be clear, this is ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results