npm trusted publishing with OIDC is generally available - GitHub Changelog
As of today, npm trusted publishing with OpenID Connect (OIDC) is now generally available. This feature enables you to securely publish npm packages directly from CI/CD workflows using OpenID Connect (OIDC) for authentication, reducing the need to manage long-lived tokens. What’s new With trusted publishing, you can now: Publish packages without npm tokens: Configure your packages to accept publis
GitHub - hand-dot/supabase-rls-checker: Supabase RLS Checker is a Chrome extension that automatically verifies Row Level Security (RLS) settings for Supabase databases used by websites. It detects tables with disabled RLS settings that should be protectin
With the growing popularity of vibe coding, more people are now able to participate in service development. However, over the past few months, I've discovered and reported vulnerabilities across more than five websites, leading to the exposure of over 10,000 pieces of personal information, such as email addresses. During this process, it became clear that many services are being released without s
npm 'accidentally' removes Stylus package, breaks builds and pipelines
HomeNewsSecuritynpm 'accidentally' removes Stylus package, breaks builds and pipelines npm has taken down all versions of the real Stylus library and replaced them with a "security holding" page, breaking pipelines and builds worldwide that rely on the package. A security placeholder webpage is typically displayed when malicious packages and libraries are removed by the admins of npmjs.com, the wo
Malware detection policies | ReversingLabs Spectra Assure documentation
Malware detection policies are a group of software quality policies used by the Spectra Assure platform to help you improve the overall software package security. These policies are used during software package analysis to check your code and inform you if any of the built-in validation rules are violated. Specifically, malware detection policies focus on identifying malicious and suspicious softw
AbuseIPDB - IP address abuse reports - Making the Internet safer, one IP at a time
Report abusive IPs engaging in hacking attempts or other malicious behavior and help fellow sysadmins! Report IP Now What is AbuseIPDB? AbuseIPDB is a project dedicated to helping combat the spread of hackers, spammers, and abusive activity on the internet. Our mission is to help make Web safer by providing a central blacklist for webmasters, system administrators, and other interested parties to
Claude Codeをサンドボックス上で実行する(Mac編)
2025-07-06 設定ファイルと起動オプションに不備があったので修正しました。今度こそ大丈夫です！！！！！ 2025-07-09 設定ファイルに不備があり、セッションの更新がされずAPIエラーになる事象を修正しました。本当に今度こそ大丈夫だと思います！！！！！！！ 2025-07-10 挑戦に失敗はつきもの Claude Codeくんは便利ですが、ちょっとドジなところもあるので目を離すのはちょっとこわいですね。 このようなときはVMやコンテナで開発環境を完全に隔離すれば安全安心が手に入るわけですが、プロジェクトごとに設定するのは面倒くさい。 悪意のないAIのうっかりミスを防げる程度の軽量なサンドボックスがあると嬉しいのですが、Macには意外と手頃なものがないんですね。 普段dev containerを使ってる人ならそれで良さそうですが、わたしはMac上で直接開発したいので……。 ところ
Releases now expose digests for release assets - GitHub Changelog
GitHub now automatically computes and displays SHA256 checksums (digests) for all uploaded release assets. These digests are generated at upload time, immutable, and let you verify that downloaded assets haven’t been altered since publishing. This improves integrity and transparency for every release. You can view or retrieve asset checksums anywhere you access releases: The GitHub Releases UI, ne
プロンプトインジェクション対策: 様々な攻撃パターンから学ぶセキュリティのリスク - GMO Flatt Security Blog
はじめに こんにちは、GMO Flatt Security株式会社セキュリティエンジニアの石川(@ryusei_ishika)です。 近年、ChatGPT や Gemini などの大規模言語モデル（LLM）をはじめとする生成 AI の活用が急速に進んでいます。その一方で、これらの AI モデルに対する新たな攻撃手法である「プロンプトインジェクション」が注目を集めており、そのセキュリティリスクが問題視されています。 この記事では、プロンプトインジェクションが実際にどのような脅威となり得るのか、具体的な事例を交えながらそのリアルなセキュリティリスクを解説します。さらに、開発者や経営者が取るべき具体的な対策についても、分かりやすくご紹介します。 また、GMO Flatt Securityは日本初のセキュリティ診断AIエージェント「Takumi」や、LLMを活用したアプリケーションに対する脆弱性診
Node.js — Wednesday, May 14, 2025 Security Releases
Security releases available Updates are now available for the 24.x, 23.x, 22.x, 20.x Node.js release lines for the following issues. Improper error handling in async cryptographic operations crashes process (CVE-2025-23166) - (high) The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js
ブラウザデータを狙うInfostealerと対策技術について | セキュリティ研究センターブログ
はじめに "Information Stealer (Infostealer)"は、端末から様々な情報を窃取するマルウェアです。多くのInfoStealerは、ブラウザが保存している機微データ（例えば、ユーザによって入力されたログインIDやパスワード、クレジットカード情報、Cookie*など）を窃取します。*Cookieとは、セッション管理、個人設定の保持、トラッキングなどの目的でブラウザ内に保存されるデータです。Cookieを盗まれると、場合によっては不正アクセス等につながる危険性があります。 Infostealerの感染経路は多々ありますが、最近では、"ClickFix"と呼ばれる、偽のCAPTCHA画面やアップデート画面などを通じてユーザにPowershellを実行させ、最終的にInfostealerに感染させるというソーシャルエンジニアリング手法が多発しており、注意が必要です。 本
GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 4/2)
GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 4/2) Executive Summary Update April 2: Recent investigations have revealed preliminary steps in the tj-actions and reviewdog compromise that were not known until now. We have pieced together the stages that led to the original compromise, provid
Next.js Support Policy | Next.js by Vercel - The React Framework
Next.js publishes new versions to the canary channel daily. These pre-release builds undergo extensive internal testing before being promoted to a stable release. While we encourage you to experiment with the latest features on canary, we do not recommend serving production traffic from these versions. Once a major version is released, it enters the long-term support (LTS) phase. We highly encoura
Postmortem on Next.js Middleware bypass - Vercel
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps. Timeline2025-02-27On 27 Feb 2025 06:03:00 GMT, the vulnerability was disclosed to the Next.js team through GitHub private reporting. The researchers also emailed security@vercel.com. The initial report disclosed the vulnerability in older versions of Ne
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Incubation: Inline Integrity · Issue #1135 · w3ctag/design-reviews
https://secure.software/
Active Supply Chain Attack: npm Phishing Campaign Leads to Prettier Tooling Packages Compromise
GitHub - WICG/local-network-access: A proposal to restrict sites from accessing a users' local network without permission
アプリケーション固有の「ロジックの脆弱性」を防ぐ開発者のためのセキュリティ観点
Localhost dangers: CORS and DNS rebinding
GitHub - azu/nextjs-cve-2025-29927-poc: Next.js PoC for CVE-2025-29927