2024 Sonatype Blog
Conversations about software supply automation, devsecops, open source, continuous delivery, and application security.
- Posts
- 1,657 from 1 Jun 2007 to 29 Oct 2026
- Posting
- weekly (28 in the last year)
- Kind
- company blog
- Feed
- https://www.sonatype.com/blog/rss.xml
Latest
October 2026
- Shadow AI Across Government: It's Three Problems, Not One
- How Maven Central Builds Trust Into Dependency Delivery
- A Protected Browser Doesn't Mean Your Enterprise Is Remediated
- The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass
- eMudhra CA Incident: Sonatype's Assessment and Guidance
- PHP2Shell Makes PHP Inventory and Patch Ownership Urgent
- The New Release Metric: Less Cleanup Per Release
- AI Noise Is the New Development Bottleneck
- Trust What Ships: Your Repository Is Now Your First Defense
- Hijacked TensorLake npm Turned Install Into Credential Risk
- Q3 2026 Open Source Malware Index: When Compromise Compounds
- What Are the New Rules for Secure Open Source Consumption?
- Your Agents Are Choosing Dependencies. DoWI 8430.01 Says You Own the Result.
September 2026
August 2026
- Managing Air-Gapped Environments: Ensuring Security and Efficiency
- Key Takeaways from Black Hat 2026: AI, CVSS, and Security Basics
- Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads
June 2026
May 2026
- Your Outdated Repository Still Works, But It May Not Be Safe
- How to Build a Software Supply Chain Security Playbook
April 2026
March 2026
- Critical Java Vulnerability in pac4j: CVE-2026-29000 Explained
- OMB's Rollback on Software Security Increases Risks
- The Evolution of OSS Index in the Age of AI | Sonatype
February 2026
January 2026
December 2025
September 2025
- npm Software Supply Chain Attack Highlights New Risks
- AI Risk Management Framework for Federal Security | Sonatype
August 2025
- SBOM Manager New Features Accelerate Compliance and Security
- The Unchanging Laws of Software in the Age of AI | Sonatype
July 2025
- Scaling InnerSource with Automation for Secure Development
- Q2 Open Source Malware Index 2025: Data Exfiltration Threats
June 2025
April 2025
February 2025
- Strategies to Secure Multi-Environment Deployments
- Automate SBOM Reporting for U.S. Army Compliance | Sonatype
October 2024
September 2024
July 2024
May 2024
April 2024
- How DevOps Pioneers Lead Organizational Transformation
- Automate and Maintain SBOMs for Better Software Security
March 2024
- Comparing and Converting SBOM Formats: CycloneDX vs. SPDX
- Secure Software Development Attestation Form | Sonatype
- What Are SBOM Standards and Formats? | Sonatype
February 2024
- Unlock the Power of Binary Repositories: A Guide for DevOps
- From DevOps to DevSecOps: Integrating Security into SDLC
January 2024
December 2023
June 2023
May 2023
April 2023
February 2023
December 2022
October 2022
- Best Practices for Managing Software Supply Chain Security
- This Week in Malware - Nearly 40 Packages Discovered | Sonatype
September 2022
July 2022
April 2022
- Malware Wrap-up: npm Backdoors, Bugs, Mystery Placeholders
- Wicked Good Development Episode 6: The Logic of Code Quality
February 2022
- Roblox and Fortnite Spam Floods PyPI, NuGet, and npm
- Sonatype Celebrates February 3, 2022 as World Open Source Day
January 2022
September 2021
May 2021
March 2021
November 2020
July 2020
June 2020
- ZeroTrustOps: Securing at Scale
- Enhancing CI/CD Pipelines with Sonatype and Bitbucket Code
- Optimizing Platform Health with Synthetic Monitoring
- Enhance Your Code Quality with Sonatype and Atlassian Integrations
- Publishing Docker Images on Sonatype Nexus Repository with Maven
May 2020
April 2020
- Optimizing Software Supply Chains with Nexus Repository
- Sonatype-2020-0196: Protect Bitcoin From Malicious RubyGems
- Transforming DevOpsSec into DevSecOps: Lessons from Breaking Bad
March 2020
February 2020
January 2020
December 2019
- Critical Vulnerability in Bouncy Castle: CVE-2018-5382
- New in Nexus Repository: R Format and VS Code Support
October 2019
September 2019
- Sonatype Intelligence CVE-2019-15753: OpenStack (os-vif)
- The Dot Zero Conundrum: A New Frontier of Secure Open Source
- Building a Secure Web: Insights from Global AppSec DC 2019
- Micro Focus + Sonatype Partnership Enables Enhanced AppSec
- Improving DevSecOps at the GSA | Sonatype Blog
August 2019
June 2019
- Developers Must Embrace DevSecOps for a Secure Digital Future
- Implementing DevSecOps: Building Security into Your DevOps Pipeline
- The Neuroscience Behind Effective DevOps Culture Transformation
- DevOps Tools, Not Rules | Sonatype
May 2019
April 2019
- Washington Magazine Ranks Sonatype on Best Places to Work
- CVE-2019-0232: Apache Tomcat Remote Code Execution
- Malicious Attacks on Open Source Are Going to Get Worse
- Explore DevSecOps Reference Architectures | Sonatype
January 2019
- Dynamic Storage Enhancements: 4 Improvements to Blob Storage
- https://www.sonatype.com/blog/2019/01/nexus-intelligence-insights-february-2019/-0
November 2018
- Security by Press Release Risks: Lessons from jQuery Vulnerability
- Welcome back to nexus intelligence insights
October 2018
September 2018
- Three Days of DevSecOps: Lessons From Equifax | Sonatype
- Improving Security Pipelines with Simple Yet Brilliant Solutions
May 2018
April 2018
March 2018
February 2018
January 2018
December 2017
September 2017
March 2017
- Deterministic DevSecOps: Best Practices | Sonatype
- Sonatype on Federal News Radio
- Using Sonatype Nexus Repository 3: npm Packages | Sonatype
April 2016
February 2016
January 2016
December 2015
November 2015
- Qa running docker in production
- Software supply chains devops lessons learned from southwest airlines
- Why nexus rocketed beyond 60000 installs
- Improving container security docker and more
- Nexus firewall quality at velocity
- Java deserialization vulnerability
September 2015
August 2015
July 2015
June 2015
- Rework is choking software 2015 state of the software supply chain report
- The 2015 state of the software supply chain report
April 2015
March 2015
February 2015
January 2015
December 2014
- A Time for Cyber Supply Chain Management in Congress: Part 2
- Our promise free nexus training
- Nexus 2 11 1 why its time to upgrade
- Cyber supply chain managemnt part 3
- Nexus support rubygems
- Cyber supply chain management part1
November 2014
Every year
2026 272025 112024 122023 52022 102021 32020 142019 202018 102017 52016 52015 192014 502013 272012 722011 432010 842009 952008 322007 3
Undated 1110
- Security should stop being a drag
- Sonatype nexus is rising above the swamp
- Preventing an sbom f bomb streamline compliance in your software supply chain
- Devsecops without compromise
- Why companies should contribute to open source and how to do it
- Why developers are becoming the weakest link in supply chain attacks
- Wicked good development dev nexus part 2
- The mythos ai vulnerability storm what to do next
- How to measure the maturity of your software supply chain
- The world bank groups cloud journey with devsecops
- Accelerate devops with sonatypes multi product aws offering
- Sonatype hosts global gatherings of devsecops leaders and innovators
- Mission velocity mission assurance why federal software security demands both
- This week in malware 400 npm packages target azure uber airbnb developers
- Five ways to improve your code quality
- Application health check free tool to see if youre impacted by the struts2
- Cursedgrabber strikes again sonatype spots new malware campaign against software supply chains
- Devops in the 3rd inning devsecops in the 1st says sonatype ceo
- Apache servers actively exploited in wild importance of prompt patching
- Automated enforcement the not so subtle difference between sonatype nexus and everyone else
- Microsoft acquires npm a healthy move for critical public infrastructure
- Npm packages rspack vant compromised blocked by sonatype
- Devops making the boring things stay boring
- Understanding swft the latest effort to modernize dod software procurement
- Protecting the software supply chain insights from our expert panel
- Why software composition analysis is essential for open source security
- Summary of the science of compliance early code to secure your node by judy johnson
- Useful docker images part 1
- Software dependency cooldowns are a symptom not a strategy
- Optimising out the waste in open source publishing
- Search guard central repository
- Researcher takes over qr.js via repo hijacking. is the npm package safe
- Software bill of materials going mainstream
- Hands on with the nexus platform a software supply chain demo
- Nexus lifecycle report redesign survey
- Confessions from fannie mae liberty mutual and capital one
- Highly available docker registry on aws with nexus
- Owasp top 10 introduction with caroline wong video
- Sonatypes 10 year journey with co founder brian fox
- Securing the ai stack for federal missions
- Devsecops for a dollar or less
- Hid globals three pillars of operational security
- Wicked good development episode 1
- Auditing the use of open source software
- What does nists definition of critical software mean
- Each for equal international womens day 2020 theme resonates in devsecops as a business issue
- Sonatype muse how improved code quality compliments enterprise sast
- Struts2 vulnerabilities who is responsible
- Software composition analysis precision definitely matters just ask our competitors
- From abuse to alignment why we need sustainable open source infrastructure
- What goes great with slsa sonatype
- The shifting landscape of open source supply chain attacks part 3
- The magic of a remote organization
- Post conference tech spec why building your ship application with raw materials is a bad idea
- Build better component practices crawl. walk. run
- Shift left is no longer early enough for software security
- Secret life of maven central
- Ai is forcing a new open source security model
- How developer morale affects software supply chain
- Gartner report how sboms improve security and compliance in the software supply chain
- Nexus innovator jasmine james of delta
- How manufacturing best practices can improve open source consumption and software supply chains
- Why software composition analysis sca demands precision
- Keeping third party dependencies in check with nexus
- Mapping the javascript genome for devops
- Fake npm roblox api package installs ransomware spooky surprise
- 5 reasons developers still download malicious packages
- Bloomberg industry german4
- Fake vs code extension on npm uses altered screenconnect utility as spyware
- Dora ict risk management framework what to know
- Securing software supply chains and dependency confusion an industry perspective
- The power of data in devsecops
- How capital one automates automation tools
- Cd projects openshift and tekton
- Transforming enterprises with generative ai pallavi nargunds keynote at addo
- How to video training on open source component management and intelligence
- Wicked good development demystifying tech debt
- https://www.sonatype.com/blog/sonatype-nexus-3-launches-into-mesosphere-dc/os
- Sonatype lifecycle and firewall now available in the cloud
- Maven central and the tragedy of the commons
- The llm dependency trap
- Why namespacing matters in public open source repositories
- Russ eling talks founding oss consultants and open source compliance
- Maven deploy to sonatype nexus repository
- New in nexus repository 3.25
- Devsecops embracing automation while letting go of tradition
- Beyond coding changing developer roles
- Four steps to get started with nexus repo using new rest apis
- Alert three things to know about the newest struts2 vulnerability
- Introducing our 9th annual state of the software supply chain report
- Embracing dependency management in software development
- Cd with openshift
- Rsac 2018 preview of opening session for devops connect devsecops day podcast
- Why ai demands a new approach to shift left
- Sonatypes road to continuous delivery our product owners perspective
- Anatomy of a continuous delivery pipeline
- Devsecops eat carrots not cupcakes
- Central publisher portal now validates sigstore signatures
- Software composition analysis
- What is dependency confusion and why does it matter in the federal sector
- Wicked good ted newards philosophy 101
- Devsecops dreams teams and architecture
- Equifax and struts an ounce of prevention is worth a pound of cure
- Devsecops chaos engineering
- 2018 state of the software supply chain report
- Devops metrics measuring what matters
- Unveiling the trillion dollar engine of innovation manuel hoffmanns keynote at addo
- Streamline your sbom management with sbom manager
- From generic code to specialist ai how mcp will reshape the developer experience
- Take this interactive devsecops reference architecture for a test drive
- From chaos to control establishing an ospo for strategic governance
- Manage open source licenses in financial services
- New pymafka malicious package drops cobalt strike on macos windows linux
- Twilio npm is brandjacking malware in disguise
- Application security trends shift left security ai and open source malware
- Sonatype is now awardable on the platform one solutions marketplace
- It pays to discover sonatype
- Devops escape the blame game
- Iwd19 1
- Start with devsecops reference architectures
- Devops and opportunities in software supply chain governance
- Nexus repository 3.7.0 released
- New on sonatype learn easy source control management scm onboarding
- Nexus intelligence insights whats in a ghostcat cve 2020 1938 apache tomcat
- 5 practical ways your organization benefits from devsecops
- Malicious code injection strikes again as npm foils 13m cryptocurrency theft
- The true cost of not having a cloud repository
- Explore a refreshed sonatype platform new features new product names
- How to upskill your devops
- Sonatype nexus 3.2 installation admin login and port change video
- Npm packages caught spreading bladeroid info stealer
- Eu cyber resilience act good for software supply chain security bad for open source
- Sonatype a cybersecurity impact award honoree
- What does the new cvss 3.1 scoring model mean for enterprise security
- This week in malware oct 07 22
- What is grounding why ai coding assistants need better intelligence
- Sonatype nexus containers with persistent storage in azure container instances
- Gdpr gets teeth british airways and marriott fined
- Github pull requests
- Wicked good development java queens at devnexus 2023
- Improve your karma with devops culture in a box
- Sonatype guide giving ai the context it needs
- New nexus lifecycle enhancements deliver faster remediation experience
- Sandworm mode the rise of adaptive supply chain worms
- Openssf responds to cisa advocates for a multifaceted approach to software identification
- Cyber readiness and sboms
- Rust in the enterprise best practices and security considerations
- Another day of malware malicious botaa3 pypi package
- Gdpr compliance why the best defense is a great offense
- Congress calls for cybersecurity doctor doctor cant you see
- Inside the fallguys malware
- A clear path forward toward more secure and maintainable open source software
- How to use sboms to root out project vulnerabilities
- Docker devops new ordinary
- Yes understanding gender is a professional issue
- New npm poc packages target paypal zettle airbnb developers
- 10 ways kubernetes enables devops
- Rust rising navigating the ecosystem and adoption challenges
- Devsecops community survey for 2018
- How to use nexus repository with maven deploy video
- Future proofing your software supply chain with sca best practices
- Common security acronyms explained
- Scale up your enterprise with docker subdomain routing
- Anatomy of the rubygems rest client hack and getting creative about open source security
- More than 200 cryptominers flood npm and pypi registry
- The shifting landscape of open source supply chain attacks part 2
- Increasing the dependability of devops processes
- Oss index contributor asks where r you
- New integration to visual studio code nexus iq and oss index
- Meet the developers behind sonatypes automated malware detection system securing open source supply chains
- Proxy a conda repository using nexus repo
- Maven central past present and future
- Devsecops a beginners guide
- Securing the software supply chain a federal imperative for 2026
- Securing the ai era sonatype safeguards open source software supply chains
- Becoming a new contributor to open source software
- 2 rapid reset zero day
- Apache tomcat vulnerability widespread exploitation and key insights from sonatype
- Dependency mapping a beginners guide
- How to keep vulnerable versions of struts out of your nexus repository
- Developers need two things the nexus platform and a full pot of coffee
- Ai malware and the rise of software development infiltration
- Software liability gets real global
- Automation you can trust cut backlogs without breaking builds
- Nexus innovator bryan batty of bloomberg industry group part 4
- Plg journey at sonatype
- How to audit sboms for enhanced software security
- Enhancing software supply chain security new sonatype product capabilities
- Software packages do we even need them
- How to safeguard your software supply chain
- Axios compromise on npm introduces hidden malicious package
- The path of devops enlightenment for infosec
- Careful out there open source attacks continue to be on the uptick
- Ai models attackers next potential target
- Brian fox what does sonatype do what do i do all day
- Nexus lifecycle improved jira add on
- Empowering developers security self serve and automated time based waivers
- Sonatype repository firewall is an easy solution for a big problem
- Sonatype vulnerability scanner and vulnerability analysis
- Malicious package detection sonatype protects software supply chains
- The owasp zap hud
- Sbom a rama fall 2024 sonatypes top 5 takeaways
- Devsecops elite and their reference architecture
- Ai is hard work
- Spring4shell by the numbers
- Why you need devsecops and artifact repositories
- Nexus repository manager 3.8 is now available
- Pypi flooded with over 1200 dependency confusion packages
- Sonatype nexus lifecycle boosts open source security and dependency management
- Revolutionizing software development frank roes keynote at addo
- The impact of security testing on an organization
- Storage management best practices part 2
- How a surf loving aussie developed sonatypes most popular extension
- A tale of two language package registries
- Mastering software governance in air gapped critical mission environments
- White house national cybersecurity strategy landmark action for a critical threat
- Advanced development pack
- Npm search changes
- Make sure to cover your auth
- Owasp top 10 overview
- Tish long and steve hills two more reasons why sonatypes future is bright
- Blue by default
- Software supply chain a definition and introductory guide
- Joining the finos ai security initiative
- Wicked good development simon brown on visualizing software architecture
- Developers say goodbye to vulnerabilities. squash those bugs
- Polyfill.io supply chain attack hits 100000 websites all you need to know
- Rubygems laced with bitcoin stealing malware
- Centralsecurityproject
- Uk government to step up supply chain security following us presidential executive order on cybersecurity
- Offline not off guard countering software supply chain threats in high security environments
- Bloomberg industry german1
- Are you still wondering about dependency confusion attacks
- Comparing sbom standards spdx vs. cyclonedx vs. swid
- Improving build time of java builds on openshift
- Taming the wild west of shadow ai
- Pytorch namespace dependency confusion attack
- Sonatype 2020 0003 npm malicious package 1337qq js
- Nexus lifecycle xc is now available
- Poland developer conference recap
- Embracing the ai revolution navigating the impact on developers
- Learn the nexus rest api automating sonatype nexus
- Tracing the solarwinds exploit upstream
- Importanceofopensourcepolicy
- Summer compliance webinar series understanding the cyber resilience act
- Years old apache struts2 vulnerability downloaded 325k times in the past week
- How large organizations can easily scan for log4j vulnerabilities
- Onboarding sonatype lifecycle through scm
- Webinar series future of cybersecurity requirements
- New 0 day spring framework vulnerability confirmed
- Using sonatype nexus repository with the new docker hub rate limits
- Whats happening with java
- Dependency management versions choice and the software supply chain
- Sonatype rising perspective from saastr 2018
- Open source basic practices for higher quality code
- How to find out applications that have a given component
- Why did log4shell set the internet on fire
- How can adversaries exploit npm modules
- The shifting landscape of open source supply chain attacks
- How can slsa help secure your software supply chain
- Java serialization. the gift that keeps on taking. part 1
- Sonatype named best open source devops tool
- Customer spotlight discover how sonatype is helping lead the way in software supply chain security
- Sonatype releases nexus repository 3.0
- Rolling out nexus in a large organization
- Is supermicro real who cares. supply chain attacks are happening and its time to talk about it
- How devops at scale and tool onboarding relate
- Cleanup old docker images from sonatype nexus repository
- Nexus innovator ken dauria proves practice and theory
- Containers are just another piece of the puzzle
- Protecting your development environment lessons from log4j and beyond
- How to get started with sonatype nexus repository manager oss
- Elevate your organizations success submissions now open for the 2025 sonatype elevate awards
- Nexus repo supports apt
- Transitioning your software supply chain management sscm to the cloud
- The road to software success at fannie mae is paved with devops native tools
- Optimizing sbom sharing for compliance and transparency
- Remote code execution vulnerability cve 2017 8046 in pivotals spring framework
- Policy oriented reporting with nexus lifecycle
- Devops express how it happened and why we did it
- Cve 2018 16487 lodash rce prototype pollution
- 2025 predictions threats
- Open publishing commercial scale
- Sonatypes commitment to customers and employees during covid 19
- Devsecops secrets in the cloud
- Malicious dependency confusion copycats exfiltrate bash history and etc shadow files
- Malware removed from maven central
- How sboms power secure software acquisition
- Developing with docker and sonatype
- How much value are you getting from nexus lifecycle
- Cd with kubernetes
- The new sonatype learn self service educational materials where and when you need them
- Is cyber liability insurance a moral hazard in the us
- Sonatype discovers two malicious npm packages
- Cocoapods conda in nexus repository
- A demand for real consequences sonatypes response to cisas secure by design
- Why are dependency confusion attacks not going away
- This week in malware aug 18
- Numbersdontlie
- Nist adopt a secure software development framework ssdf to mitigate risk of software vulnerabilities
- Three devsecops lessons drawn from conversations with 45 cisos
- Insecure at any speed
- Malicious intent open source developers please protect your users
- Mastering sboms best practices
- Setting up a secure private sonatype nexus repository
- This week in malware killing windows defender with an npm package
- Pypi package secretslib drops fileless linux malware to mine monero
- Top 6 reasons the time is now for devsecops in the federal government
- Vor security brings ossindex to sonatype
- Wtf is devsecops by eliza may austin
- What the 2026 state of the software supply chain report reveals about regulation
- How to use nancy to improve your go application security
- Inevitable earthquakes and exploits
- Intuits devsecops war games gamification and culture hacking
- Developers gain contextual feedback with automated pull request commenting
- The great shift cybersecurity predictions for 2026 and the new era of threat intelligence
- Enhancing software supply chain security in financial services with sonatype and aws
- Quoi... feur from meme to malware pypi package targets windows with nullrat info stealer
- New ecosystems in sonatype lifecycle and repository firewall
- Oss endgame nexus firewall as your shield against open source invasions
- Wicked good development testcontainers with oleg selajev
- Corrupting the software supply chain lessons from the bootstrap sass hack
- Counterfeit eslint and node types libraries downloaded thousands of times abuse pastebin
- Definition of devops
- Integrating infrastructure as code into a continuous delivery pipeline
- Nexus firewall grows with support for pypi
- 5 benefits of integrating iq server with your ide
- Do you view your appsec tools as an inhibitor to innovation or a safety measure
- Gartner you must assess overall software health and welfare
- 2020 state of the software supply chain report
- This week in malware sept 16 22
- Caroling through the season the sounds of the 4shells
- Whats in your jquery not the fishy jquery lh we hope
- Fannie mae scaling the devops enterprise
- New nexus firewall release with developer first enhancements
- Wicked good development the struggle with open source licensing
- The open source software index is boss heres why
- Unmasking the invisible threat ilkka turunens keynote at addo
- Violationsdetail
- New nexus repository visualizer provides insights into log4j usage
- Multiple crypto packages hijacked turned into info stealers
- Sast vs dast
- Wsj on struts companies still downloading flaw linked to equifax breach
- Sbom management and generation how sonatype leads in software supply chain visibility
- Advancing application delivery
- The evolution of open source risk persistent challenges in software security
- Emerasoft and lifecycle
- Wicked good development build breaking and more with abn amros ingmar vis
- Devops intelligence changes the game
- Theres no nice way to say this your devops has gone horribly wrong
- The ai productivity paradox more code not more delivery
- A new openssl vulnerability is coming get ready to patch
- Kubernetes recipe sonatype nexus 3 as a private docker registry
- Why devops recommends shift left testing
- This week in malware fileless linux cryptominer 100 packages
- Understanding nexus container 5 technologies you need for full life cycle container security
- Nexus innovator bryan batty of bloomberg industry group part 3 of 4
- Nexus repository 3.3 delivers git lfs and new component intelligence
- Continuous integration in pipeline as code environment with jenkins jacoco nexus and sonarqube
- Thoughts on security
- Gain visibility and traceability of your software supply chain with sboms with new gartner report
- Devops the blue ocean tide is rising
- What toyota unlocked decades ago drives software supply chain management today
- Are you a fool with a tool
- Devsecops with sonatype and saltworks security
- Npm packages use travis.yml files to conceal macos malware disguised as safari updates
- Is manual remediation with repository health check as good as it gets
- Microcosm your gateway to a secure devops pipeline as code
- Strengthening software supply chains for everyone why grafeas is a great idea
- Sonatype launches customer focused program sonatype innovate
- Migrating yum to nexus repository manager 3
- Sonatype repository firewall now supports artifactory customers
- Wicked good development what is spring4shell and why you should care
- Supply chain security inside and out
- Sonatype statement struts2 and equifax breach
- Log4j another code execution bug should you worry
- What the openssl vulnerabilities are and arent
- Python dateutils a moner cryptominer in disguise for windows linux macos
- New shai hulud miasma wave hits hundreds of npm packages
- Generative ai centric technologies get gartner report
- Free isnt free the hidden costs of tooling decisions in open source infrastructure
- Unlock collaboration and efficiency in software management with sboms
- Wicked good development vulnerability drills
- Sonatype innovate real peer connections real product influence real recognition
- Rule over your dependencies and scan at your own open source risk
- Ai governance and risk in securing software supply chains
- Preparing for pci dss 4.0 how sonatype sbom manager can streamline and accelerate your transition
- 2025 federal retrospective the year of resilient innovation
- Open source and diversity in tech womensonatype
- Securing software at the speed of ai what four years of data reveal
- How and why to design your teams for modern software systems
- The rise of collective defense for open source
- How were staying connected with our channel partners in a virtual world
- Exploring rust language adoption
- Take control of your innersource components with innersource insight
- New year new cve a deep dive into the node forge cve 2022 0122
- Kubernetes in 10 seconds
- Malicious npm package disables windows defender antivirus
- Cybersecurity awareness month building a safer digital world together
- Qa with the nexus support team
- Npm flooded with 748 packages that store movies
- Less gates more guardrails devsecops lessons learned in 2017
- Sonatype ceo on the future of the software supply chain
- Introducing sonatype depshield free for github developers
- Why llms make terrible databases and why that matters for trusted ai
- Security program to shift left operationalizing security controls via devsecops
- Log4shell and a global pandemic have in common
- Devsecops tools a beginners guide
- Bloomberg industry german2
- Data driven look at open source risk management
- Miasma returns leo platform compromise in npm
- What a year of dora reveals about cyber resilience
- The first mile of trusted ai development
- Stop open source malware at the gate with repository firewall
- Software composition analysis tools
- This week in malware aug 26 22
- 2017 state of the software supply chain report 1
- Protecting software developers with ai ml
- Building trusted ai development with kiro and sonatype guide
- 2019ssc
- Open source governance equifax and the ceo
- Nancy on a boat announcing nancy for docker
- Dod ready software embracing the swft initiative with confidence
- Leading a devops team at a fortune 100 company
- Nexus repo and datree integration deliver automated pipeline control
- Software composition analysis sca a beginners guide
- Devsecops goes mainstream
- Deploysecureapplication
- One team 5000 jobs life in the devops jungle
- Policy governance made easy introducing the nexus notifier plugin for bitbucket
- Shai hulud is back maintainers the target
- For distributed teams its not all about the tools
- Nexus intelligence insights sonatype 2018 0622 xlsx sheetjs regular expression denial of service
- Securing your software supply chain with cisas new sbom guidance
- The evolution of open source malware from volume to trust abuse
- How to use sonatype oss index to identify security vulnerabilities
- Nexus repository rising say hello to the new pro
- Deep diving into cve 2021 22114 spring integration zip path traversal
- Open source attacks on the rise top 8 malicious packages found in npm
- Definition of devsecops
- Docker compose for nexus platform
- This week in malware sept 23 22
- Cyber mayhem attackers actively exploit vulnerable confluence servers
- Streamline sca with sonatype build safe automation
- Why you need a software bill of materials more than ever
- Wicked good development evolution supply chain attacks
- How to use gitlab ci with sonatype nexus repository
- Pyfetcher netfetch drop netflix checker on windows
- Why software supply chain security requires a new playbook
- Pypi package ctx compromised are you at risk
- An ideal pypi typosquat solana py is here to steal your crypto keys
- Q1 2026 open source malware index
- Bladabindi njrat rat in jdb.js npm malware
- Despite what some vendors say please dont ignore log4j
- Katie arrington
- Java serialisation the gift that keeps on taking part 3
- Nexus repository manager retention policies and cleanup survey
- Beyond open vs. closed understanding the spectrum of ai transparency
- A cause for celebration reaching 100 m in arr and welcoming our first president
- Self propagating npm malware turns trusted packages into attack paths
- Continuous authorization with devsecops
- Whatsapp double free double trouble
- Tracking the noblox.js npm malware campaign
- Open source policy management how sonatype supports security at scale
- Ossindex update
- Happy developers produce more secure software better business outcomes
- Bracing for impact in more ways than one apache struts2 s2 053
- Faker npm library gets new home
- When cyber attack meets heart attack
- 5 reasons to not miss sonatype at rsac 2025
- Ai changes the software supply chain and how we secure it
- Helping developers implement cisa best practices part 1
- Using sonatype nexus repository 3 part 1 maven artifacts
- Your guide to appsec tools sast or sca
- How ai and vibe coding are changing the rules of software security
- Dear bintray and jcenter users heres what you need to know about the central repository
- Women in cybersecurity on the shoulders of giants
- Nexus repository manager 3.5
- Going online with the owasp vulnerability management guide working group
- Using webhooks to integrate with quay part 2
- Identifying security vulnerabilities inside a jenkins pipeline
- Struts one two punch knocks out india
- Why do i need a binary repository manager
- Sonatype spots malicious npm packages
- Medical device security a new look at open source software
- Power secure swift development at scale with sonatype nexus repository
- Six memorable sessions with government devsecop leaders what we learned
- The cloud dish
- Open source risk management
- Devops building better pipelines
- Red hat cloud services npm packages hijacked
- Cyber resilience act the future of software in the european union
- Wrapping up a decade of insights from the state of the software supply chain
- Newly found npm malware mines cryptocurrency on windows linux macos devices
- The central repository stands to support sailors from bintray how to migrate
- October is cyber security awareness month. open source developers are some of our best guardians
- Announcing gonexus
- This week in malware dependency overflow
- Devops radio podcast the story behind all day devops
- Crypto enthusiasts flood npm with 281000 bogus packages overnight
- Malicious aptx python package drops meterpreter shell deletes netstat
- 2025 predictions regulations
- Devsecops catching fire
- A new 0 day log4j vulnerability discovered in the wild
- How are federal agencies implementing devops system modernization
- The exploited ivanti connect ssrf vulnerability stems from xmltooling oss library
- The shift toward unified platforms in application security
- How is the sonatype safety rating determined
- Discord squashes critical electron bugs open source attacks continue to grow
- Kubesecops kubernetes security practices you should follow
- Sbom best practices what global leaders are asking and doing
- From burping to flying red teaming with nexus at intuit
- Gartner report how to respond to the threat landscape in a volatile complex and ambiguous world
- How to become an oss champion
- This week in malware oct 14 22
- Cve program uncertainty
- Docker handling circular dependency between containers
- Guardrails make ai assisted development safer by design
- Stringjs typosquat caught with discord info stealer
- Devopsmaturity
- This week in malware oct 28 22
- 10 years of software supply chains navigating the growth risks and future of open source
- Sonatype at rsac 2025
- This week in protestware and tale of struts rce
- Software dependencies a beginners guide
- Why devops success requires more than x ray vision
- Struts2 vulnerability cracks equifax
- Mythos found 10000 vulnerabilities. the bigger challenge is fixing them
- A guide for open source software oss security
- Deploy private docker registry on google cloud platform with nexus
- Malware monthly november 2022
- When we might learn and where we dont
- Continuous integration in the age of containers part 1
- What to consider when crafting your oss policy
- Cve 2019 7238 in nexus repository manager 3
- Why the worlds vulnerability index cannot keep up
- How the sec charges against solarwinds highlight the cybersecurity liability of software companies
- The essential duo of sca and sbom management
- Ftc warning in wake of log4j
- Decrypting the ledger connect kit compromise a deep dive into the crypto drainer attack
- Achieving a managed state model for your software supply chain
- To succeed devsecops must actually include devops
- Being the b in lgbtqia
- Success metrics
- Anonymous access in nexus repository manager
- 5 steps to turn your rmf backlog into a continuous ato the csrmc migration playbook
- Microservice architecture on kubernetes
- Optimizing efficiency and reducing waste in open source software management
- 2020 devsecops reference architecture
- Zero day now what
- When ai writes code who governs the dependencies
- 8th annual state of the software supply chain report
- Government spotlight devops accelerates cyber security
- Best practices for authentication and authorization yoshiyuki tabatas keynote at addo
- Evolving development with software composition analysis and software bills of materials
- Compromised litellm pypi package delivers multi stage credential stealer
- I have an sbom now what
- This week in malware sept 30 22
- Principle based devops frameworks accelerate
- This week in malware july 15th edition
- A proactive defense utilize sboms and continuous monitoring
- Manage and eliminate technical debt
- Insecure llm output handling and how to build safe defenses
- Owasp top 10 application security meets ai risk
- Github integration with nexus lifecycle
- Start building your cra compliance strategy now
- Hijacked npm packages deliver malware via solana linked to glassworm
- Continuous integration in the age of containers part 2
- Open is not costless reclaiming sustainable infrastructure
- What golden dome requires from federal devsecops teams
- Why security matters for devops
- Employee spotlight sue jasmin
- 86 malicious npm packages named after popular nodejs function names
- Npm manifest confusion what is it and do you really need to worry about it
- 10 reasons why all day devops 2017 is awesome
- The curios case of a german smartphone why software supply hygiene matters
- Key takeaways from the latest dod enterprise devsecops fundamentals update
- How software composition analysis sca can help you go from good to great
- House oversight report equifax open source breach was entirely preventable
- Nexus helps cure cancer
- Ai devsecops and the future of application security the gartner report
- The history of maven central and sonatype a journey from past to present
- Openai data leak and redis race condition vulnerability that remains unfixed
- Devs flood npm with 10000 packages to reward themselves with tea tokens
- Major government attack highlights log4j resolution shortfall
- Shifting security left the innovation of devsecops
- Mythos and the ai vulnerability storm
- Cve 2020 2100 jenkins udp amplification reflection attack distributed denial of service
- Summer compliance webinar series understanding dora compliance
- Devsecops the carrot and the stick
- Using nexus iq server with webpack
- Addo 2019
- Demo restricting access to nexus repository based on roles and user permissions
- 2019 devsecopssurvey
- Leadership lessons adapting to an all remote workforce
- 2017 struts2 vulnerability exploit speed matters
- Nexus intelligence insights cve 2018 1109 braces regular expression denial of service redos attack 0
- How to upskill your team with kubernetes
- Sonatype now soc2 certified
- How to publish java artifacts to nexus using jenkins and maven
- Docker scanning
- Struts2 breach at equifax was 100 preventable. heres how
- Npm libraries colors and faker sabotaged in protest by their maintainer what to do now
- Extreme endurance required
- Introducing sonatypes latest release our logo
- Heartbleed the open source vulnerability that keeps on giving and taking
- Cve 2024 3094 the targeted backdoor supply chain attack against xz and liblzma
- A point of inspiration
- Cd credentials
- Remediation at scale lessons from paypal for the equifax security team
- Bloomberg industry german3
- Devsecops leadership forum 500 innovators learning from shared experiences
- Malware monthly december 2022
- Internet of things cybersecurity improvement act of 2017
- What users really look for in a sca solution
- Can kubernetes keep a secret
- Congratulations to the sonatype 2022 elevate awards winners
- Weaponizing open source through job recruiting
- Secure your software supply chain with the sonatype and github integration
- Bryson koehler equifax cto discusses the road ahead
- Can the open source community save europe from the cyber resilience act
- Nexus repository 3.9 released with a new upload ui and firewall support
- Unlocking the power of generative ai in software development insights from sonatypes survey
- Navigating australian ism guidelines for software development
- What are the elements of an sbom
- What constitutes a software supply chain attack
- Take our survey microservices containers and serverless development
- Azure devops integration now available sonatype lifecycle
- Salesforce and nexus the real results of automation
- This week in malware may 13th edition
- How do application level package managers work
- Sonatypes 2022 the year in review
- Jackson databind remote code execution
- Maven central supports tls 1.2 only june 15
- Return on investment in software composition analysis
- Cve 2020 17479
- Saltstack 20 breaches within four days
- Money doesnt buy happiness but happy developers protect money
- The countdown to nis2 is on understanding its scope and requirements
- Software supply chain attacks solarwind how developers fortify apps
- Continuous delivery for all
- Pycharm and nexus repository manager a match made in heaven
- New feature repository routing
- Auto remediation now available
- 2021 state of the software supply chain
- Wicked good development key takeaways from the state of the software supply chain report
- Npm chalk and debug packages hit in software supply chain attack
- Myth busting in devsecops
- Cmmc 2.0 in action operationalizing secure software practices across the defense industrial base
- Securing the skies software supply chain readiness for unmanned aircraft systems
- 2025 predictions artificial intelligence ai
- Java serialisation the gift that keeps on taking part 2
- Cd platform
- Beyond npm audit
- Open source licenses explained
- Staging in nexus repository 3.11
- https://www.sonatype.com/blog/how-to-use-nexus-repository-and-helm-for-ci/cd
- 2025 predictions industry
- Pypi crypto stealer targets windows users revives malware campaign
- Vmware vsphere dependency confusion attempt caught by sonatype
- New in nexus repository 3.24 storage optimization at scale and nuget v3 hosted
- In the dark about software supply chain vulnerabilities
- Non programmer introduction to the software supply chain
- 5 tools to automate sbom creation
- Cors parser npm package hides cross platform backdoor in png files
- Nis2 readiness ensure compliance with the eu cybersecurity directive
- Security by design the benefits of building quality in
- The benefits of remote work extend beyond avoiding the coronavirus
- Easy day js targets mastra dependency attacks grow
- Bidens executive order on improving national cyber defense everything i need to know i learned in kindergarten
- Build smarter with ai and your software supply chain
- 5 key open source security risks and how to prevent them
- Nexus innovator bryan batty of bloomberg industry group part 1 of 4
- This week in malware typosquats in pypi dependency confusion packages
- The future of dependency management in an ai driven sdlc
- Building resilience and dora compliance lessons gaps whats next
- The end of tribal knowledge why contextual policy is the foundation for agentic ai development
- Cra and ai regulation whats next for software compliance
- How to access npm packages after securing sonatype nexus
- This week in malware apache kafka typosquats shorthand data exfiltration
- Free software but no free lunch
- How does securing the software supply chain fit the dod cio zero trust architecture
- Nexus repository 3.12 support for s3 blob stores
- 0 0
- Gitlab automated merge requests
- Project highlights for world open source day my open source tools
- 8 more struts breaches
- Q1 updates in nexus repository more formats stronger operations and a better day to day experience
- Improving the nexus search experience
- 2018 devsevops community survey
- Dirty rivers flow downstream leading to dirty reservoirs
- The curious case of csrf magic a case study in supply chain poisoning
- I cant go to that devops conference
- Hygiene for open source softwareis now a pci requirement
- Sonatype can help you navigate dora compliance
- Walking the walk on package registry sustainability
- Top 5 tomcat vulnerabilities
- New in nexus repository 3.23 nexus intelligence via npm audit
- What i learned from devsecops leaders in a high tech world
- Sonatype recognized as a leader in sca software in forrester wave
- Mastering sboms demonstrations
- What federal agencies need to know about cisas 2025 sbom minimum elements
- Malicious pypi package vmconnect imitates vmware vsphere connector module
- A closer look differentiating software vulnerabilities from malware
- Cyber risk in 2019 its about the supply chain stupid
- Cancer sucks. devops helps
- Celebrating sonatypers
- Wicked good development jug aka the java user group
- Full lifecycle container security
- State of the software supply chain 2019 podcast
- What you need to know about the codecov incident a supply chain attack gone undetected for 2 months
- Licensing fedora blocks creative commons
- The weakest link might be your supply chain just ask the pentagon
- Wicked good development tom cools
- Product management in a devops world
- Beyond ips addressing organizational overconsumption in maven central
- Disrupt yourself or be disrupted
- The second coming of shai hulud attackers innovating on npm
- Sonatype celebrates world open source day 2023
- Setting up sonatype nexus 3 as your windows docker container registry
- Jobs as code
- Deja vu all over again another new apache struts vulnerability cve 2018 11776
- Sonatype goes to cloudbees days
- Microsoft visual studio integration with nexus lifecycle
- Nexus on the ascent
- Abn amro continuous delivery sonatype nexus
- Slaying the dragon of oss legal compliance with the advanced legal pack
- The 2016 state of software supply chain report
- How to use the new repository health check 2.0
- 3 million cryptocurrency heist malicious github commit
- Sonatype welcomes antoine harden as regional vice president of federal
- Java at 30 from portable promise to critical infrastructure
- Lessons learned again npmgate
- Nexus reference platform kompose openshift and helm
- The impact of automating open source dependency management
- Nist proposes standards to secure government sdlc
- Sca and sast what do they do and how can they help developers like you
- Reduce ai token waste by getting decisions right earlier
- A decade of transformation the 10th annual state of the software supply chain
- This week in malware tell me your secrets
- Flooding dropper hits npm with 850 malicious packages
- Phantomraven npm malware
- Implementing devsecops with 1162 apps
- From risks to resilience best practices for software supply chain security
- The trump white house takes aim at cybersecurity
- Considering nexus auditor you should but know these things first
- The top 5 trends every ciso needs to know for 2024
- Damaging linux mac malware bundled within browserify npm brandjack attempt
- The transformation of open source lessons from the past decade
- Closing the gaps protecting your pipeline from open source malware
- Focusing on vulnerability prioritization is missing the ai era point
- Nvd overload unveiling a hidden crisis in vulnerability management
- Microsoft and github open sources future is brighter than ever
- Modernizing nexus repository moving beyond orientdb
- Gartner the crucial role of oss license compliance
- Addo session building observability to increase resiliency
- A better way to learn sonatype products
- Devsecops maturity model a beginners guide
- Malicious npm colors typosquats pack discord malware
- All things maven
- Devsecops hope is not a strategy
- Nexus repository helps developers overcome new docker hub rate limits
- Sonatype lifecycle best practices getting started and managing sboms
- Cve 2019 7238 in nexus repository manager 3 0
- Sonatype lifecycle enhancements boost speed security and productivity
- Whats the future of cyber security
- Transforming software compliance with ai sbom management
- Open source malware index q3 2025
- Nexus firewall supports rubygems rpm
- Why financial services is the canary in the code mine
- The new engineering problem managing what ai decides to import
- Whats happening with the crowdstrike incident when a software update turns into a cyber crisis
- Open source best practices key documents to help welcome new contributors to your project
- 10 best practices for microservice architectures
- Nexus reference platform docker stack and kubernetes
- Ransomware in a pypi sonatype spots requests typosquat
- Smarter policy and advanced component search
- Getting started with sonatype depshield an introduction
- Gartner mitigate risk by hardening the software supply chain
- A tale of two sdlcs rise of the ai powered sdlc
- Uncovering the invisible threat why your network may still be at risk
- Sonatype catches new pypi cryptomining malware via automated detection
- Building trusted ai development with antigravity and sonatype guide
- Lottie player compromised in supply chain attack all you need to know
- Three new react vulnerabilities surface
- Enhanced support for python in nexus lifecycle
- Cve 2017 17461 vulnerable or not
- Smart teams use atlassian and sonatype to plan development work
- What is package dependency management
- Apache struts vulnerability live updates
- Top 8 malicious attacks recently found on pypi
- How mosa principles will reshape the dod rmf
- Devsecops in time for security
- Can you spot this cryptic reverse shell found in pypi packages
- Holding the industry accountable
- This week in malware john deere dependency confusion attempt and more
- Bypassing picklescan sonatype discovers four vulnerabilities
- Cloud security concerns in 2021
- Devsecops slaying the myths of container security
- The owasp llm top 10 and sonatype supply chain security
- Defining community open source is harder than it looks
- U.s. governments guidelines for securing software suppliers
- Manage open source risk with improved malware detection
- Malicious roblox cookie and discord token stealers hit pypi repository
- Sonatype unveils state of the art artificial intelligence component detection
- Fake ip checker utilities on npm are crypto stealers
- Open source malware index q4 2025 automation overwhelms ecosystems
- Best practices in dependency management cooking a meal of gourmet code
- Open source open infrastructure and the space between
- House oversight committee 6 strategies for modern cybersecurity risks
- Wicked good development dev nexus part 1
- Namespace confusion minimizing risk with nexus repository
- Addo session secure your application supply chain on aws
- Continuous compliance and devops
- Automated setup of a repository manager
- Sonatype releases new nexus firewall policy to secure software supply chains from dependency confusion attacks
- Pypi and npm flooded with over 5000 dependency confusion copycats
- Sonatype users reveal the benefits of automated devsecops
- The hidden threat tackling malware in your software supply chain
- Python packages peek into your telegram set up windows rdp access
- A guide to deployment models self hosted cloud and air gapped
- Pgp vs. sigstore a recap of the match at maven central
- Nexus repo issue neither bug nor vulnerability
- How to navigate devops principles analyzing shift left and secure right
- Hugging face security incident a new class of threat is here
- The most underutilized policy type in lifecycle
- What is owasp
- Why developer experience is the foundation of devsecops success
- Bintray to the central repository
- Cve 2019 13354 strong password
- Strategies to accelerate dependency management for modern enterprise software development
- Devops at massive scale
- The overview effect two decades of unique perspective
- Sonatype cto appointed to cyber resilience experts panel amidst growing financial compliance demands
- Python packages upload your aws keys env vars secrets to web
- Oss for enterprise
- The hidden national security threat inside ai driven software
- Breaking silos for security
- Zero day vulnerabilities a beginners guide
- Sonatype named a visionary in the 2025 gartner magic quadrant for application security testing
- Addo session the state of sbom whats coming in standards and regulations
- Demystifying vex simplifying sboms with sonatype sbom manager
- This week in malware npm malware exfiltrates windows sam amazon ec2 credentials
- This week in malware sept 2 22
- What tpgs 80m investment means for the future of sonatype and the devsecops movement
- Fully automated container security
- How sonatypes container scanning protects you from zero days
- Nexus innovator bryan batty of bloomberg industry group part 2 of 4
- Deloitte names sonatype in technology fast 500 for fourth consecutive year
- Sonatype nexus repository as a container registry
- Jackson databind the end of the blacklist
- Compliance as code
- Mr. smith goes to washington equifax congress
- Starting at sonatype is sort of a homecoming
- Improving code quality with automation
- A decade as a woman in cybersecurity what i wish i had known
- 3 steps to deal with the aftermath of the highjacked eslint scope package
- How procurement relates to security part 1
- Managing ai risks in the modern software supply chain
- The developers hippocratic oath in the age of ai
- Embedding ownership a devops best practice
- How to improve your software supply chain with a software security framework
- Sonatype acquires musedev and unveils full spectrum software supply chain management system
- 5 quick wins for securing continuous delivery
- Nexus repository microsoft nuget gallery odata changes for nuget v2
- What you should know about the struts 2 vulnerability announcement video
- Simplifying sbom compliance with sonatype under indias cybersecurity framework
- Everything matters why the npm package sparked controversy
- Open source components code volume drag down web app security new report from imperva
- Cve 2023 50164 another vulnerability in the widely used apache struts2 component
- The no fix mediums not having a high priority doesnt mean low danger
- Devops as a service
- Lazarus groups latest brandjacking campaign on npm
- Wicked good development dev nexus part 3
- Pursue growth with a software engineering internship at sonatype
- Promise theory and devops
- Golden pull requests automating trusted remediation without breaking builds
- Ai impact on the future of automation and ethics insights from gartner report
- Nexus platform 2019 year in review
- Sonatype expands global innovation with new india engineering center
- Sonatype board member ann winblad talks devops and open source on cnbc
- Managing open source software risks with the herodevs eol dashboard
- Exploit creator selling 250 reserved npm packages via telegram
- New developer tools for open source dependency management
- 2023 predictions software supply chain governance
- Equifax was 100 preventable by 18000 others at risk
- The magic behind over 101000 malicious packages
- Cve 2019 3773 spring web services xml external entity injection xxe
- Chinese military implicated in equifax breach
- This is the new op model why state farm sponsored addo and the results
- Grounded intelligence is key to safe ai software development at scale
- Assessing your open source software security efficacy
- Navigating new regulations and the role of sboms in software security
- Java jepdy. sometimes you just have to let your hair down
- Keep applications secure in bitbucket with automated pull requests
- From sboms to ai boms why spdx 3.0 matters
- Cybersecurity improvement act of 2017 the ghost of congress past
- Enhance security with the sonatype lifecycle and gitlab ultimate integration
- Principle based devops frameworks three ways
- Using webhooks to integrate with quay part 1
- 91 spring cves highlight the growing ai vulnerability consumption problem
- The rise of dependency scanners
- Llm vector and embedding risks and how to defend against them
- Government asks whats in your software
- Nexus intelligence insightscve 2020 13935 apache tomcat
- Storage management components in motion
- Devops assurance with owasp samm
- Kubernetes for developers
- Nexus repository manager just got yummier
- Devsecops integrating automated security controls
- Fooled twice by the same open source problem shame on you
- How sboms drive a smarter sca strategy
- Sonatype a recognized cybersecurity tech titan
- Dependency hijacking software supply chain attack hits more than 35 organizations
- Sonatype lifecycle best practices reference policies backup and restore
- Why sboms are essential for every organization
- Top 9 devops conferences a developers picks
- Owasp security knowledge framework
- Nexus intelligence insights cve 2014 3483
- How many hosted repositories can nexus oss support
- Malware monthly march 2023
- Introducing nexus intelligence insights
- Accelerating productivity digital value streams and devsecops during covid 19
- Revived cryptojs library is a crypto stealer in disguise
- Repository management its not just for the jvm
- Modernizing federal devsecops for cmmc and beyond
- The three rs of software supply chains reject replace and respond
- Workflow automation publishing artifacts to sonatype nexus using jenkins pipelines
- What is container security and how can you boost yours
- Sonatype uncovers global espionage campaign in open source ecosystems
- Building a security minded development team devsecops tools and sdlc best practices
- New ecosystems available in nexus lifecycle
- Governing open source and ai in mitigating modern risks in software development
- How sonatype leads in ai component analysis for supply chain security
- Log4j exploits are now being used to spread dridex banking trojan
- Malware monthly january 2023
- Customer education get up to speed with maven repository configuration in our new learning module
- Gdpr and oss. how are they linked and why should you care
- A world of infinite choice in open source software
- Prioritizing open source vulnerabilities is reachability useful
- Using sonatype nexus repository 3 part 3 docker images
- Gitlab instant inline indispensable developer insights
- Nexus repository 3.0 qa
- Signal over noise reachability analysis is the reality check sca has been missing
- Find fix vulnerabilities in seconds with github pr reviews with line comments
- Cve 2024 53677 a critical file upload vulnerability in apache struts2
- Wicked good james mcleod finos and beyond
- The last mile problem ai can write code but only policy can ship it
- Setting up a docker private registry with authentication using nexus and nginx
- Struts2 cve 2023 50164 by the numbers
- New policy grandfathering automating open source governance at your own pace
- How devsecops is transforming the application security profession
- Npm packages caught exfiltrating kubernetes config ssh keys
- Forrester recognition market leader in software composition analysis
- Sonatype nexus repository community edition
- Why diversity shouldnt be a vanity project
- Sonatype lifecycle now integrates with azure devops to secure software supply chains in the cloud
- Npm project used by millions hijacked in supply chain attack
- Core ai technology and the foundation of future innovations get gartner report
- Sonatype spots 150 malicious npm packages copying recent software supply chain attacks
- Principle based devops frameworks calms
- When it comes to application security doing your homework matters
- How much should the federal government worry about log4j
- World open source day what we learned
- This week in malware vmware secrets and security by obscurity
- Turkish banking regulations
- Crytic compilers typosquats known crypto library drops windows trojan
- How to protect yourself against trojan source unicode attacks with nexus firewall
- Federal devsecops leaders its time to join the conversation
- Wicked good fall 2022 maven central updates
- Step by step block and quarantine vulnerable open source components and artifacts with nexus firewall
- The owasp llm top 10 and sonatype data and model poisoning
- Container considerations on your devops journey
- Open source software is under attack new event stream hack is latest proof
- From awareness to assurance in federal software development
- This week in malware malicious distutil and spring4shell active exploits
- Getting started with the secure software development framework ssdf
- Leaky secrets a 326m crypto hack do your github commits reveal too much
- Sonatype named devops dozen winner for best devsecops solution
- Operating without an oss license that could be dangerous
- Counterfeit lodash attack leverages anydesk to target windows users
- Better software development insights from the sbom scorecard
- Steps to responsible disclosure
- Scale developer security with expanded nexus platform features
- White house executive order software supply chains
- Javascript scanning supported jetbrains ides intellij idea webstorm
- Devsecops is suddenly strategic for everyone in software heres why
- Sso authentication and conan in nexus repository 3.22
- Intro to malware analysis analyzing python malware
- Safer software sooner devsecops in government
- Remember npm library colors theres no such thing as colors 2.0
- Trust at scale the commons threats and ai in the loop
- You cant manage what you cant see open source governance starts with visibility
- Are unnecessary vulnerabilities polluting your software supply chain
- This week in malware a fix crash info stealer and 500 malicious npm packages
- Trojanized pypi package imitates a popular python server library
- Make sure your company is prepared for evolving liability regulations
- Is your repository ready for whats next
- Sbom from the idea of transparency to the reality of code
- New sonatype scan gradle plugin
- Sbom vdr and maven transforming the apache logging experience to a common pattern
- System hardening with ansible
- What is hashing a look at unique identifiers in software
- Nexus repository 3 what is a repository manager
- Sonatype customers leading with innovation in the new year
- Request for comments care and maven central
- Custom node module management using private npm registry configured in nexus repository
- Open source software license management
- Hollywood formalizes support for open source in filmmaking
- Devsecops and the fda
- A reported log4j rce is more complicated than it looks
- From o to accredited in 23 days
- Tackle cyber resilience act requirements with our cra checklist
- Nexus repository now certified in red hat openshift 1
- Why high quality data is critical for effective software composition analysis
- Department of defense devsecops journey
- Sonatype automated deployments with atlassian bitbucket pipelines
- Sonatype dependency management mcp server now live in oss mcp registry
- From feature to vulnerability a spring security oauth2 client story
- Vista acquires a majority interest in sonatype
- How stolen information stealers are fueling an underground market
- Devops at the us patent and trademark office
- Q2 2026 open source malware index attackers abuse developer trust
- Ai is making software autonomous and governance must follow
- Notable sonatype awards
- Octopus scanner compromises 26 oss projects on github
- Npm hijackers at it again popular coa and rc open source libraries taken over to spread malware
- Atomic arch npm campaign adds malicious dependency
- Making sure our users dont zip slip and fall
- Unprecedented automation indonesianfoods pits open source against itself
- Unraveling the struts2 security vulnerability a deep dive
- Gdpr one year on
- Maven central and sigstore
- Wicked good development episode 2
- Prioritizing and automating for optimal developer velocity and business outcomes
- Stop the low quality contribution plague
- Running the nexus platform behind nginx using docker
- Accelerate secure releases with microsoft copilot and sonatype guide
- The hugging face incident changes the vulnerability equation
- Hijacked npm package attempts to deliver polinrider linked rat
- A devsecops journey at a dutch bank
- Want to understand software supply chains ask red hat
- Cyber readiness and changing federal government sbom requirements
- The path forward for the nexus platform
- Inside a 176 package npm campaign built to beat your internal dependencies
- Distraction technique npm get cache
- Central repository moving to https
- The nexus firewall perimeter defense for software development
- This week in malware sep 9 2022
- Dso survey launch 2019
- Forrester software composition analysis wave and the future of devops
- Sonatype nexus installation using docker
- Discord.dll successor to npm fallguys
- Autonomous development and ai speed vs. security
- This npm package could have brought down cloudflares entire cdn and millions of websites
- New design new features maven central improvements for developers
- Celebrating the 2025 sonatype elevate awards finalists
- How to extract your android projects dependencies with a gradle task
- Docker compose for nexus platform part2
- Maturing devops in td bank
- Sonatypes sbom generation capabilities outpace the competition
- Red hat summit is like a beautiful open source component heres why
- How to integrate sboms into the software development life cycle
- Kaseya ransomware supply chain
- Devops table stakes the minimum amount required to play the game
- Devsecops leaders the conversation continues online may 7th
- Malware monthly february 2023
- Pypi packages steal telegram cache files add windows remote desktop accounts
- Publishing private npm packages to nexus
- Deploying devops in government the second time is the charm
- Agentops is here what devsecops leaders need to do now
- Devops for small organizations lessons from ed
- Experimenting with the nexus welcome page
- Managing nexus api using jenkins x
- Devsecops in the age of containers
- Introducing nexus intelligence insights 0
- From a commodore 64 to devsecops
- Npm packages target solana devs drop keylogging trojans
- Improve acsc recommended maturity model
- Behind the baseline reflecting on the launch of the open source project security baseline
- Neuvector
- Learn about sonatype products with new self paced guides and courses
- Shadow downloads how developers have become the new perimeter
- What can we learn from 200 billion javascript downloads
- Malicious pytorch lightning packages found on pypi
- Mini shai hulud npm attack more than 2200 components impacted
- Keeping your sonatype nexus repositories clean just got easier
- What is a software bill of materials
- Sonatype named best place to launch a career
- Sonatype depshield now protects npm projects
- Nexus lifecycle and intellij idea
- Bridge the security gap
- Vulnerability handling requirements for nis2 compliance
- Time to upgrade nexus repository 2 to java 8
- The future of developer velocity with sonatype and aws
- Hijacking of a known github id go bindata
- New in sonatype nexus repository 3.30 microsoft azure blob storage support for expanded cloud platform deployments
- Walmart integrates nexus oneops jenkins kubernetes into distribution center management system
- Wicked good development white house unveils new national cybersecurity strategy
- Devsecops leadership forum revolutionizing financial services
- Helm nexus steering towards faster deployments in nexus 3.21
- Managing infrastructure at scale with terraform
- Devops made of steel
- Compare npm audit versus auditjs
- Secure reliable terraform at scale with sonatype nexus repository
- Unnecessary risk the persistence of open source vulnerabilities
- Pypi attackers still at it malicious packages drop trojans and info stealers
- Secure by design preparing for gdpr should begin with software
- Pypi cheese shop malware illustrates software supply chain risk vector
- How to establish an open source program office