ALL DAY DEVOPS^®

Join us on October 10th for the world's largest DevOps conference. ADDO is 24 hours of free, online content presented by industry leaders and practitioners. Register to secure your spot.

Register Today

Skip Navigation

Platform
- - Platform overview Automate your software supply chain security
  - Integrations Work in the tools, languages, and packages you already use
Solutions
- - Integrated Innovation Align dev, security, and ops teams to fuel secure deployment
- By Industry
Pricing
Resources
- - Resource Center Articles, videos, and reports that help transform the way you innovate.
Partners
- - Become a Partner Join our extensive Sonatype Partner Network
  - Find a Partner Find and connect with a certified Sonatype partner
Company

Book a Demo

Sonatype Blog

Discover valuable insights on DevOps, Application Security, Software Innovation, Vulnerabilities, Software Supply Chain Management, SBOMs and Sonatype products.

Blog Post

What's happening with the CrowdStrike incident: When a software update turns into a cyber crisis

Blog Post

Exploit creator selling 250+ reserved npm packages on Telegram

Blog Post

'cors-parser' npm package hides cross-platform backdoor in PNG files

Blog Post

Russia-linked 'Lumma' crypto stealer now targets Python devs

Filter by

The shifting landscape of open source supply chain attacks - Part 3

Blog Post

The shifting landscape of open source supply chain attacks - Part 2

Blog Post

The shifting landscape of open source supply chain attacks - Part 1

Blog Post

A guide to deployment models: Self-hosted, cloud, and air-gapped

Blog Post

Going online with the OWASP Vulnerability Management Guide Working Group

Blog Post

Wicked Good Development Episode 25: The struggle with open source licensing

Blog Post

Intro to malware analysis: Analyzing Python malware

Blog Post

Dependency management: Versions choice and the software supply chain

Blog Post

Malware Monthly - December 2022

Blog Post

Sonatype Lifecycle boosts open source security and dependency management

Blog Post

Meet Richard Panman: Values Champion

Blog Post

Best practices in dependency management: Cooking a meal of gourmet code

Blog Post

2023 predictions: What will happen in software supply chain governance?

Blog Post

PyTorch namespace (dependency) confusion attack

A diagram showing the complementary role SAST and SCA tools play in modern software security. SAST analyzes first-party source code for vulnerabilities, while SCA scans third-party dependencies.

Blog Post

SCA vs. SAST: How they work together to enhance software security

1
...
12
13
14

Platform

Solutions

Community

Partners

Company
- Careers
- Contact
- About
- Newsroom
- Trust Center
- Investors
- Press Kit

Subscribe for all the latest software security news and events

Terms of Service
Privacy Policy
Modern Slavery Statement
Event Terms and Conditions
Do Not Sell My Personal Information

Copyright © 2008-present, Sonatype Inc. All rights reserved. Includes the third-party code listed here. Sonatype and Sonatype Nexus are trademarks of Sonatype, Inc. Apache Maven and Maven are trademarks of the Apache Software Foundation. M2Eclipse is a trademark of the Eclipse Foundation. All other trademarks are the property of their respective owners.