This is a guest post for the Computer Weekly Developer Network written by Henrik Plate in his capacity as a security researcher at Endor Labs - a company known for its approach to ‘reachability .
The National Institute of Standards and Technology (NIST) published a new draft that outlines strategies for integrating 54 SSC security measures into CI/CD pipelines.
Open-source packages with large language model (LLM) capabilities have many dependencies that make calls to security-sensitive APIs, according to a new Endor Labs report.
If ChatGPT is fabricating code libraries or packages, attackers could use these hallucinations to spread malicious packages without using suspicious and already detectable techniques like typosquatting or masquerading.