Sonatype Logo dark

Platform
- Products
- Why Sonatype
- Accelerate Pipelines with the World's Leading Artifact Repository Manager
  
  Try It Free
- Explore solutions for you
Solutions
- OSS Management
- Developer Solutions
- Industry
- Sonatype Named a Leader in Forrester Wave™ for SCA Software
  
  Read Report
Pricing
Resources
- Resources
- Customer Resources
- Developer Community
- Research Vulnerabilities and Find the Safest Components for AI-Driven Development
  
  Get Started Free
Company
- Company
  - About
  - Customer Stories
  - Events
  - Newsroom
  - Careers
  - Blog
  - Contact Us
- Partners
- Contact Us
  
  Speak to a Software Supply Chain Expert
  
  Contact Us
Login Contact Us Book a Demo

Login Contact Us Book a Demo

This is a search field with an auto-suggest feature attached.

There are no suggestions because the search field is empty.

Posts by Sonatype Security Research Team

Filters

Search

Topics

AI

Application Security

DevOps

Malware & Vulnerabilities

Regulations & Compliance

SBOM

Software Development

featured image for Atomic Arch: Attackers Hijack Trusted AUR Packages to Deliver Rootkit-Like Malware

Blog Post

Atomic Arch: Attackers Hijack Trusted AUR Packages to Deliver Rootkit-Like Malware

Read More

featured image for New Shai-Hulud Miasma Wave Hits Hundreds of npm Packages

Blog Post

New Shai-Hulud Miasma Wave Hits Hundreds of npm Packages

Read More

featured image for Lazarus Group's Latest: Brandjacking Campaign on npm

Blog Post

Lazarus Group's Latest: Brandjacking Campaign on npm

Read More

featured image for Red Hat Cloud Services npm Packages Hijacked

Blog Post

Red Hat Cloud Services npm Packages Hijacked

Read More

featured image for Inside a 176-Package npm Campaign Built to Beat Your Internal Dependencies

Blog Post

Inside a 176-Package npm Campaign Built to Beat Your Internal Dependencies

Read More

featured image for Hijacked npm Package Attempts to Deliver PolinRider-Linked RAT

Blog Post

Hijacked npm Package Attempts to Deliver PolinRider-Linked RAT

Read More

featured image for Shai-Hulud Is Back, and npm Maintainer Accounts Are Still the Soft Target

Blog Post

Shai-Hulud Is Back, and npm Maintainer Accounts Are Still the Soft Target

Read More

featured image for PyTorch Lightning Compromised With Two Malicious Package Versions Published

Blog Post

PyTorch Lightning Compromised With Two Malicious Package Versions Published

Read More

featured image for Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Blog Post

Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Read More

featured image for Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses

Blog Post

Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses

Read More

featured image for Axios Compromise on npm Introduces Hidden Malicious Package

Blog Post

Axios Compromise on npm Introduces Hidden Malicious Package

Read More

featured image for Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer

Blog Post

Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer

Read More

1
2
3

Platform

Nexus One Pricing Nexus Repository Firewall Lifecycle Guide SBOM Manager Maven Central

Why Sonatype

Compare Sonatype Open Source Intelligence Best SCA Tools Best Malware Protection Tools Best Artifact Repository Solutions Best SBOM Compliance Solutions

Resources

Resources Center Blog Product Tours Webinars Customer Stories Analyst Reports Research

Developer

Integrations All Day DevOps (ADDO) Free Nexus Repo Download Sonatype OSS Index OSS Component Search MCP Server Security Advisories

Customer Resources

My Sonatype Documentation Support

Company

About Careers Partners Newsroom Trust Center

Contact Us

X social logo
LinkedIn social logo
Facebook social logo
YouTube social logo
GitHub social logo

Terms of Service
Privacy Policy
Modern Slavery Statement
Event Terms and Conditions
Do Not Sell My Personal Information
Cookie Preferences
Trust Center

Copyright © 2008-present, Sonatype Inc. All rights reserved. Includes the third-party code listed here. Sonatype and Sonatype Nexus are trademarks of Sonatype, Inc. Apache Maven and Maven are trademarks of the Apache Software Foundation. M2Eclipse is a trademark of the Eclipse Foundation. All other trademarks are the property of their respective owners.