Helping developers build with confidence. Stewards of Maven Central.
- Tweets 15,885
- Following 898
- Followers 10,554
- Likes 8,460
How does Maven Central handle malicious packages, and where do the registry’s responsibilities end? We’re discussing it on r/MavenCentral, where the Central team is active and can join the conversation.
teddit.net/r/MavenCentral/s/…
158
A certificate compromise can leave trust behind in places developers may not think to check. We published script to help audit developer environments for eMudhra certificates. It’s read-only by default, with optional fixes. Review the safety notes before using fix mode: github.com/sonatype-nexus-co…
259
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated remote code execution.
Inventory PHP across your services and products. Prioritize internet-facing systems, assign remediation owners, and patch promptly. For older versions, check with your vendor for backported fixes.
Details: guide.sonatype.com/security-…
1
399
Sonatype retweeted
AI agents can now find and exploit software vulnerabilities at machine speed. Join agency leaders and Sonatype on Oct 22 to talk supply chain security, AI governance, and what comes next. Free webcast: buff.ly/mH8vlQI
1
1
52
Nearly 2 million malicious open source packages to-date. In Q3 2026, nearly 3 in 4 malicious packages exhibiting overt malware behavior involved droppers, secrets exfiltration, or both. One bad package can become a much bigger compromise.
sonatype.com/blog/q3-2026-op…
238
Maven Central publishing limits are now in effect. Community OSS publishers: check your organization’s usage. Isolated overages have a grace period, and projects with unusual publishing needs can request a higher limit or exemption. We welcome your feedback as the process begins.
central.sonatype.org/publish…
290
A security headline tells you what happened. Security Events helps answer the harder questions: Are you affected? What should you check? What happens next?
Your first stop for major vulnerabilities and malicious package incidents: guide.sonatype.com/security-…
343
91 Spring CVEs. 209,569 affected components. And counting.
The hard part isn’t knowing new vulnerabilities exist. It’s figuring out what actually affects your software.
Guide turned a massive coordinated disclosure into something developers can act on ↓
guide.sonatype.com/security-…
1
382
Security teams don't have a visibility problem. They have a software decision problem.
The @sdtimes Editorial Board captured that shift in this year's SD Times 100, recognizing @sonatype alongside other organizations helping development and security teams build with greater confidence.
Read the full list:
🔗 sdtimes.com/security/securit…
291
Every AI system has a supply chain and models are only part of the picture. Datasets, open source components, APIs, and agents all shape how AI behaves and where risk can emerge.
Great insights from @KateOflaherty and @llkkaT:
🔗 insight.scmagazineuk.com/wha…
1
192
Sonatype retweeted
AUR has suspended new registrations after @sonatype researchers discovered more than 1,500 malicious packages flooded the repository, highlighting growing supply chain risks facing open-source ecosystems. #cybersecurity #CISO #infosec bit.ly/4uRsY6Q
2
3
705
Sonatype retweeted
Sonatype reports Lazarus Group’s npm brandjacking campaign uses dozens of malicious packages (e.g., buffer-utilities) to drop remote payloads, with steps for removal, investigation, and strengthened dependency reviews. sonatype.com/blog/lazarus-gr…
4
9
1,318
New React2Shell RCE vulnerabilities highlight a growing challenge for every modern software organization: the expanding risk surface created by generative and agentic AI-accelerated development.
Even widely trusted frameworks like React and Next.js can introduce pathways for remote code execution — sometimes without developers realizing the server-side behaviors involved.
Our latest blog breaks down the incident and detailed remediation guidelines.
Take a look to learn more: lnkd.in/gkVBC-YK
#OpenSourceSecurity #DevSecOps #React #SoftwareSupplyChain
1
1
2
1,677
Application security is moving fast. Is your team keeping up?
Gartner’s new “Hype Cycle for Application Security, 2025” reveals the strategies leading organizations use to cut security incidents by up to 70%—without slowing their release cycles.
Ready to stay ahead of emerging threats, streamline DevSecOps, and enable secure innovation? Get the insights your team needs to compete and win.
Download the Gartner Application Security Hype Cycle lnkd.in/giiUBr_2
#ApplicationSecurity #DevSecOps #Cybersecurity
1
1,477
Nexus Repository Cloud helps you stay one step ahead by detecting malware in both open source components and AI/ML models — directly in your proxy repository.
Add Sonatype Repository Firewall to block and remove risky packages before they ever hit your pipeline.
🛡️ Built for teams shipping faster in the AI era
Try it free with 6-month, 500GB promo lnkd.in/gxCszKkV?utm_campaig…
#RepoCloud #SoftwareSupplyChain #AIModelSecurity #DevSecOps #MalwarePrevention
861
Introducing Nexus One — a cloud-first, developer-centric, and AI-native platform.
Built on 15+ years of research and the world’s most comprehensive OSS data, Nexus One helps teams build faster, safer, and smarter.
Explore Nexus One: lnkd.in/gmN79dVw?utm_campaig…
592
The Latest on npm Supply Chain Attack nitter.siddz.com/i/broadcasts/1OyKAjRdn…
2
599
🚨 Another active attack targeting npm developers — and this one spreads itself.
We break down the evolving #ShaiHulud campaign, a new wave of self-propagating malware targeting #npm publishers:
➡️ Over 180+ compromised packages tracked so far
➡️ Multi-stage payloads exfiltrate credentials, poison repos, and auto-spread
➡️ A wake-up call: open source developers are the new frontline
Get the latest updates here: bit.ly/41WlxPY
#SoftwareSupplyChain #npmSecurity #OpenSourceSecurity #Malware #DevSecOps #CyberSecurity #SupplyChainAttack
2
649
🚨 New research: Lazarus Group targets developers through open source malware
Since January, Sonatype has uncovered 234 malicious packages tied to the North Korea-backed group — deployed via npm and PyPI to exfiltrate secrets, drop payloads, and surveil developers.
📦 120+ used multi-stage droppers
🔐 90+ focused on secrets exfiltration
🎯 36,000 potential victims
Our latest whitepaper breaks down the tactics, payloads, and what security teams can do to stay protected. Get the report: bit.ly/3HaoR2I
#OpenSourceSecurity #MalwareCampaign #DevSecOps #CyberThreats #SoftwareSupplyChain #ThreatIntel
1
2
3
605