Skip to main content

Posts

New npm Threat Bypasses Install Script Protections

A malicious npm package that has been downloaded millions of times comes with a new way of spreading the malware that makes it easier to bypass security protections, say researchers with security vendor Checkmarx. Rather than using more common preinstall or postinstall scripts, the bad actors instead created a malicious package – indexed-btree – that mimics the legitimate sorted-btree package and hides the malware in the package’s runtime code, according to Checkmarx security researcher Bruno Dias. Indexed-btree “runs entirely from application code at runtime,” Dias wrote in a report . “Additionally, this package achieved almost 2 million weekly downloads, which shows not much has changed in the npm ecosystem despite the limitations put on lifecycle scripts.” The latest malware targeting npm packages hides inside the Btree.prototype.set, the standard method in JavaScript B-Tree data structures. Because there’s no install hook inside the package.json file, installing the packag...
Post a Comment
Read more
Recent posts

Ten Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Dice Booz Allen Hamilton McLean, VA DevOps Engineer $77,600 to $176,000 Alarm.com Centennial, CO DevOps Engineer $120,000 to $130,000 HarbourVest Partners Boston, MA DevOps Engineer $135,00...
Post a Comment
Read more

GitLab Tightens Rate Limits as Coding Agents Drive Demand

GitLab is introducing new rate limits for its cloud-based DevOps platform as growing demand from AI agents and automated development tools increases pressure on its infrastructure. The changes , which begin October 19, will restrict the volume of requests users can send to GitLab.com based on their subscription plans. Free-tier customers and users making unauthenticated requests will face the new restrictions first, while Premium and Ultimate customers will see changes in January 2027. The restrictions address a challenge facing developer platforms as AI coding agents generate vast volumes of automated requests. GitLab forecasts several times more traffic on its infrastructure for 2026, prompting the company to establish usage limits designed to maintain service performance. GitLab is certainly not alone in addressing this issue. GitHub and Anthropic have also introduced rate limits as AI-powered development tools greatly boost the use of computing and network resources. Automated ...
Post a Comment
Read more

GitHub Separates Who Writes Code From Who Runs Your CI

Anyone with write access to a repository can trigger a GitHub Actions workflow. That has been the default since Actions launched. It’s convenient. It’s also a problem when a compromised account or a malicious pull request can turn your CI into an attack path. Attackers have noticed. GitHub’s own 2026 Actions security roadmap points to incidents involving tj-actions/changed-files, Nx, and trivy-action as examples of the same pattern. Go after the automation, not the application. Steal a token, and you own the pipeline. Mitch Ashley, vice president and practice lead for CIO & technology buyers and software lifecycle engineering at The Futurum Group , puts the stakes plainly. “A single compromised developer account can mean the difference between a well-running pipeline and compromised software.” GitHub’s latest answer is now generally available. On September 17, the company made workflow execution protections GA for GitHub Enterprise, organizatio...
Post a Comment
Read more

US District Court Decision in AI’s Favor Worries Open-Source Developers

A federal appeals court handed GitHub, Microsoft, and OpenAI an important win in the first major appellate ruling over how AI coding tools can use open-source code. As we all know, all the AI code-generating programs learned their lessons largely from open-source code. So a group of anonymous open-source plaintiffs argued that GitHub Copilot and OpenAI Codex were built using code from public GitHub repositories, including open-source licensed code. They argued the AI tools had generated code without the author attribution, copyright notices, and license terms that came with the original work. Now, the Ninth Circuit has returned a verdict in Doe vs. GitHub siding with Big AI. Ouch! But it may not be as troublesome as it first appears. The Ninth Circuit’s September 16 decision turns on a technical but consequential distinction: AI-generated code that lacks author names, copyright notices, and license information is not necessarily the same as code from which that information has been...
Post a Comment
Read more

Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface

Your team probably spends considerable effort securing your application. WAFs, rate limiting, input validation, penetration testing. Then code passes through a CI/CD pipeline that runs with privileged credentials, executes arbitrary code from third-party actions, has broad network access to internal systems, and logs secrets in plain text if someone makes one configuration mistake. The pipeline that builds and deploys your secure application is itself the least secure system in your infrastructure. Think about what a CI/CD pipeline actually is from an attacker’s perspective. It is a system that automatically executes code, often with administrative access to your cloud accounts, container registries, databases, and production environments. It pulls dependencies from the public internet. It runs plugins and actions written by strangers. It often has access to every secret needed to deploy to every environment. If you designed a system specifically to be an attractive target for s...
Post a Comment
Read more

Anthropic Adds a Coordinator to Claude Projects for Running AI Work in Parallel

Anyone who has run more than one Claude Code session at a time on the same codebase already knows the drill. You split the work yourself, decide which session touches which files, track what each one is doing, and then stitch the results together by hand. The model can write good code in parallel. Coordinating that parallel work has been left entirely to humans. Anthropic is trying to close that gap. On September 17, the company rolled out a redesign of Claude Projects that moves it from a static container for files and chat history into something closer to a project manager: A coordinator that breaks a stated goal into parallel threads, delegates the work, and assembles the results. The mechanics are straightforward once you see them. A user states a goal and connects the relevant repositories or context, and a coordinator thread scopes the work and spins up worker threads to handle pieces of it. Each of those threads runs as a full Claude Code cloud session on its own branch, and c...
Post a Comment
Read more