Shai-Hulud 2.0: What executives need to know about the supply-chain worm (Nov 24, 2025)

November 24, 2025November 28, 2025 bbossolacybersecurity, opensource, vulnerabilityLeave a comment

6–9 minutes

Shai-Hulud 2.0: What executives need to know about the new npm supply-chain worm (Nov 24, 2025)

On November 24, 2025, a second wave of the “Shai-Hulud” npm supply-chain attack began spreading through the JavaScript ecosystem. Attackers compromised maintainer accounts, published trojanized versions of legitimate packages, and used them as a worm to steal credentials and propagate into more projects and organizations.

What happened (in plain terms)

Trusted packages were silently replaced with malicious updates. When developers or CI systems installed these versions, the malware ran automatically during install.
The malware steals secrets at scale. The payload hunts for npm/GitHub tokens and cloud credentials, then exfiltrates them to attacker-controlled repos.
This wave is more capable than September’s. Researchers observed improved execution (including the Bun runtime) and broader credential targeting, making infection faster and harder to spot.
High-profile vendors were hit. Packages tied to Zapier, ENS Domains, Postman, PostHog, AsyncAPI and others were compromised, showing the attackers can reach well-run projects—not just obscure libs.

Why this matters to your business

This is not a “developer problem.” It is a direct enterprise risk:

Credential theft = account takeover. If a compromised package was installed in your environment, assume tokens and keys on that machine (or CI runner) may be stolen. That can lead to cloud breaches, source-code theft, or ransomware-style follow-on attacks.
Supply chain blast radius is huge. npm packages are deeply nested in modern apps. One infected dependency can taint many internal services before anyone notices. The campaign has already spread into tens of thousands of GitHub repos.
Regulatory and reputational exposure. If attacker access leads to customer data loss or service disruption, you face incident-response costs, disclosure obligations, and trust damage.

Immediate actions (next 24–72 hours) for your engineering team

If your engineering team uses Node.js / npm anywhere:

Identify exposure.
- Compare your dependency lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) to the known malicious package/version list from current advisories
- Search CI logs and build images for installs of those versions around Nov 24, 2025 onward.
- If you are using Meterian, your teams will be notified tomorrow of any outstanding issue in your projects, while you can also manually trigger a rescan
Treat potentially affected environments as compromised.
- Rotate all secrets that could have been accessible to developer machines or CI runners: npm tokens, GitHub tokens, cloud keys, DB creds, SaaS API keys.
- Re-issue creds from a clean machine.
Hunt for persistence.
- Check for unexpected GitHub Actions / CI workflows, new secrets, or unfamiliar deploy keys. Earlier Shai-Hulud waves used CI backdoors to keep access.
Block known bad versions now.
- Add deny-lists in artifact proxies (e.g., npm registry mirrors) and internal policy gates.
- Pin safe versions until the incident stabilizes.

Medium-term fixes (next few weeks) for your engineering team

Eliminate long-lived registry tokens. The attack leveraged stolen or weakly protected maintainer/CI tokens; reducing token lifetime and scope cuts worm propagation.
Harden CI/CD. Run builds in isolated runners with minimal secrets; require approvals for workflow changes.
Adopt dependency trust controls.
- Prefer verified publishing / signed releases where available.
- Add automated checks for sudden owner changes, new install scripts, or unusual publish patterns.

The take-home

Shai-Hulud 2.0 is a credential-stealing worm riding on the npm ecosystem. It spreads through normal installs, targets high-value developer and cloud secrets, and has already hit mainstream packages. The right executive posture is: assume compromise if exposed, rotate secrets fast, and tighten the software supply chain permanently. After last September’s incident, we predicted this would rear its ugly head again. Watch a brief update and warning shared earlier this week at one of our meetings.

Meterian CTO Bruno Bossola shares the growing blast radius and all consumers of NPM must stop it

This is a story under development!

Please keep an eye on this blog page, in the meantime here’s the list of affected packages and versions so far:

Package	Malicious version(s)
`Package name`	`Affected versions`
`@accordproject/concerto-analysis`	`3.24.1`
`@accordproject/concerto-linter`	`3.24.1`
`@accordproject/concerto-linter-default-ruleset`	`3.24.1`
`@accordproject/concerto-metamodel`	`3.12.5`
`@accordproject/concerto-types`	`3.24.1`
`@accordproject/markdown-it-cicero`	`0.16.26`
`@accordproject/template-engine`	`2.7.2`
`@actbase/css-to-react-native-transform`	`1.0.3`
`@actbase/native`	`0.1.32`
`@actbase/node-server`	`1.1.19`
`@actbase/react-absolute`	`0.8.3`
`@actbase/react-daum-postcode`	`1.0.5`
`@actbase/react-kakaosdk`	`0.9.27`
`@actbase/react-native-actionsheet`	`1.0.3`
`@actbase/react-native-devtools`	`0.1.3`
`@actbase/react-native-fast-image`	`8.5.13`
`@actbase/react-native-kakao-channel`	`1.0.2`
`@actbase/react-native-kakao-navi`	`2.0.4`
`@actbase/react-native-less-transformer`	`1.0.6`
`@actbase/react-native-naver-login`	`1.0.1`
`@actbase/react-native-simple-video`	`1.0.13`
`@actbase/react-native-tiktok`	`1.1.3`
`@afetcan/api`	`0.0.13`
`@afetcan/storage`	`0.0.27`
`@alexadark/amadeus-api`	`1.0.4`
`@alexadark/gatsby-theme-events`	`1.0.1`
`@alexadark/gatsby-theme-wordpress-blog`	`2.0.1`
`@alexadark/reusable-functions`	`1.5.1`
`@alexcolls/nuxt-socket.io`	`0.0.7\|0.0.8`
`@alexcolls/nuxt-ux`	`0.6.1\|0.6.2`
`@alexcolls/nuxt-ux`	`0.6.2\|0.6.1`
`@antstackio/eslint-config-antstack`	`0.0.3`
`@antstackio/express-graphql-proxy`	`0.2.8`
`@antstackio/graphql-body-parser`	`0.1.1`
`@antstackio/json-to-graphql`	`1.0.3`
`@antstackio/shelbysam`	`1.1.7`
`@aryanhussain/my-angular-lib`	`0.0.23`
`@asyncapi/dotnet-rabbitmq-template`	`1.0.2\|1.0.1`
`@asyncapi/edavisualiser`	`1.2.2\|1.2.1`
`@asyncapi/go-watermill-template`	`0.2.76\|0.2.77`
`@asyncapi/java-template`	`0.3.6\|0.3.5`
`@asyncapi/keeper`	`0.0.3\|0.0.2`
`@asyncapi/php-template`	`0.1.2\|0.1.1`
`@asyncapi/python-paho-template`	`0.2.15\|0.2.14`
`@asyncapi/server-api`	`0.16.25\|0.16.24`
`@asyncapi/studio`	`1.0.3\|1.0.2`
`@asyncapi/web-component`	`2.6.7\|2.6.6`
`@bdkinc/knex-ibmi`	`0.5.7`
`@browserbasehq/bb9`	`1.2.21`
`@browserbasehq/director-ai`	`1.0.3`
`@browserbasehq/mcp`	`2.1.1`
`@browserbasehq/mcp-server-browserbase`	`2.4.2`
`@browserbasehq/sdk-functions`	`0.0.4`
`@browserbasehq/stagehand`	`3.0.4`
`@browserbasehq/stagehand-docs`	`1.0.1`
`@caretive/caret-cli`	`0.0.2`
`@chtijs/eslint-config`	`1.0.1`
`@clausehq/flows-step-httprequest`	`0.1.14`
`@clausehq/flows-step-jsontoxml`	`0.1.14`
`@clausehq/flows-step-mqtt`	`0.1.14`
`@clausehq/flows-step-sendgridemail`	`0.1.14`
`@clausehq/flows-step-taskscreateurl`	`0.1.14`
`@cllbk/ghl`	`1.3.1`
`@commute/bloom`	`1.0.3`
`@commute/market-data`	`1.0.2`
`@commute/market-data-chartjs`	`2.3.1`
`@dev-blinq/ai-qa-logic`	`1.0.19`
`@dev-blinq/cucumber_client`	`1.0.738`
`@dev-blinq/cucumber-js`	`1.0.131`
`@dev-blinq/ui-systems`	`1.0.93`
`@ensdomains/address-encoder`	`1.1.5`
`@ensdomains/blacklist`	`1.0.1`
`@ensdomains/buffer`	`0.1.2`
`@ensdomains/ccip-read-cf-worker`	`0.0.4`
`@ensdomains/ccip-read-dns-gateway`	`0.1.1`
`@ensdomains/ccip-read-router`	`0.0.7`
`@ensdomains/ccip-read-worker-viem`	`0.0.4`
`@ensdomains/content-hash`	`3.0.1`
`@ensdomains/curvearithmetics`	`1.0.1`
`@ensdomains/cypress-metamask`	`1.2.1`
`@ensdomains/dnsprovejs`	`0.5.3`
`@ensdomains/dnssec-oracle-anchors`	`0.0.2`
`@ensdomains/dnssecoraclejs`	`0.2.9`
`@ensdomains/durin`	`0.1.2`
`@ensdomains/durin-middleware`	`0.0.2`
`@ensdomains/ens-archived-contracts`	`0.0.3`
`@ensdomains/ens-avatar`	`1.0.4`
`@ensdomains/ens-contracts`	`1.6.1`
`@ensdomains/ens-test-env`	`1.0.2`
`@ensdomains/ens-validation`	`0.1.1`
`@ensdomains/ensjs`	`4.0.3`
`@ensdomains/ensjs-react`	`0.0.5`
`@ensdomains/eth-ens-namehash`	`2.0.16`
`@ensdomains/hackathon-registrar`	`1.0.5`
`@ensdomains/hardhat-chai-matchers-viem`	`0.1.15`
`@ensdomains/hardhat-toolbox-viem-extended`	`0.0.6`
`@ensdomains/mock`	`2.1.52`
`@ensdomains/name-wrapper`	`1.0.1`
`@ensdomains/offchain-resolver-contracts`	`0.2.2`
`@ensdomains/op-resolver-contracts`	`0.0.2`
`@ensdomains/react-ens-address`	`0.0.32`
`@ensdomains/renewal`	`0.0.13`
`@ensdomains/renewal-widget`	`0.1.10`
`@ensdomains/reverse-records`	`1.0.1`
`@ensdomains/server-analytics`	`0.0.2`
`@ensdomains/solsha1`	`0.0.4`
`@ensdomains/subdomain-registrar`	`0.2.4`
`@ensdomains/test-utils`	`1.3.1`
`@ensdomains/thorin`	`0.6.51`
`@ensdomains/ui`	`3.4.6`
`@ensdomains/unicode-confusables`	`0.1.1`
`@ensdomains/unruggable-gateways`	`0.0.3`
`@ensdomains/vite-plugin-i18next-loader`	`4.0.4`
`@ensdomains/web3modal`	`1.10.2`
`@everreal/react-charts`	`2.0.2`
`@everreal/react-charts`	`2.0.1\|2.0.2`
`@everreal/validate-esmoduleinterop-imports`	`1.4.5`
`@everreal/validate-esmoduleinterop-imports`	`1.4.4\|1.4.5`
`@everreal/web-analytics`	`0.0.2`
`@everreal/web-analytics`	`0.0.1\|0.0.2`
`@faq-component/core`	`0.0.4`
`@faq-component/react`	`1.0.1`
`@fishingbooker/browser-sync-plugin`	`1.0.5`
`@fishingbooker/react-loader`	`1.0.7`
`@fishingbooker/react-pagination`	`2.0.6`
`@fishingbooker/react-raty`	`2.0.1`
`@fishingbooker/react-swiper`	`0.1.5`
`@hapheus/n8n-nodes-pgp`	`1.5.1`
`@hover-design/core`	`0.0.1`
`@hover-design/react`	`0.2.1`
`@huntersofbook/auth-vue`	`0.4.2`
`@huntersofbook/core`	`0.5.1`
`@huntersofbook/core-nuxt`	`0.4.2`
`@huntersofbook/form-naiveui`	`0.5.1`
`@huntersofbook/i18n`	`0.8.2`
`@huntersofbook/ui`	`0.5.1`
`@hyperlook/telemetry-sdk`	`1.0.19`
`@ifelsedeveloper/protocol-contracts-svm-idl`	`0.1.2\|0.1.3`
`@ifelsedeveloper/protocol-contracts-svm-idl`	`0.1.2`
`@ifings/design-system`	`4.9.2`
`@ifings/metatron3`	`0.1.5`
`@jayeshsadhwani/telemetry-sdk`	`1.0.14`
`@kvytech/cli`	`0.0.7`
`@kvytech/components`	`0.0.2`
`@kvytech/habbit-e2e-test`	`0.0.2`
`@kvytech/medusa-plugin-announcement`	`0.0.8`
`@kvytech/medusa-plugin-management`	`0.0.5`
`@kvytech/medusa-plugin-newsletter`	`0.0.5`
`@kvytech/medusa-plugin-product-reviews`	`0.0.9`
`@kvytech/medusa-plugin-promotion`	`0.0.2`
`@kvytech/web`	`0.0.2`
`@lessondesk/api-client`	`9.12.2\|9.12.3`
`@lessondesk/api-client`	`9.12.3\|9.12.2`
`@lessondesk/babel-preset`	`1.0.1`
`@lessondesk/electron-group-api-client`	`1.0.3`
`@lessondesk/eslint-config`	`1.4.2`
`@lessondesk/material-icons`	`1.0.3`
`@lessondesk/react-table-context`	`2.0.4`
`@lessondesk/schoolbus`	`5.2.2\|5.2.3`
`@livecms/live-edit`	`0.0.32`
`@livecms/nuxt-live-edit`	`1.9.2`
`@louisle2/core`	`1.0.1`
`@louisle2/cortex-js`	`0.1.6`
`@lpdjs/firestore-repo-service`	`1.0.1`
`@lui-ui/lui-nuxt`	`0.1.1`
`@lui-ui/lui-tailwindcss`	`0.1.2`
`@lui-ui/lui-vue`	`1.0.13`
`@markvivanco/app-version-checker`	`1.0.2\|1.0.1`
`@ntnx/passport-wso2`	`0.0.3`
`@ntnx/t`	`0.0.101`
`@oku-ui/accordion`	`0.6.2`
`@oku-ui/alert-dialog`	`0.6.2`
`@oku-ui/arrow`	`0.6.2`
`@oku-ui/aspect-ratio`	`0.6.2`
`@oku-ui/avatar`	`0.6.2`
`@oku-ui/checkbox`	`0.6.3`
`@oku-ui/collapsible`	`0.6.2`
`@oku-ui/collection`	`0.6.2`
`@oku-ui/dialog`	`0.6.2`
`@oku-ui/direction`	`0.6.2`
`@oku-ui/dismissable-layer`	`0.6.2`
`@oku-ui/focus-guards`	`0.6.2`
`@oku-ui/focus-scope`	`0.6.2`
`@oku-ui/hover-card`	`0.6.2`
`@oku-ui/label`	`0.6.2`
`@oku-ui/menu`	`0.6.2`
`@oku-ui/motion`	`0.4.4`
`@oku-ui/motion-nuxt`	`0.2.2`
`@oku-ui/popover`	`0.6.2`
`@oku-ui/popper`	`0.6.2`
`@oku-ui/portal`	`0.6.2`
`@oku-ui/presence`	`0.6.2`
`@oku-ui/primitive`	`0.6.2`
`@oku-ui/primitives`	`0.7.9`
`@oku-ui/primitives-nuxt`	`0.3.1`
`@oku-ui/progress`	`0.6.2`
`@oku-ui/provide`	`0.6.2`
`@oku-ui/radio-group`	`0.6.2`
`@oku-ui/roving-focus`	`0.6.2`
`@oku-ui/scroll-area`	`0.6.2`
`@oku-ui/separator`	`0.6.2`
`@oku-ui/slider`	`0.6.2`
`@oku-ui/slot`	`0.6.2`
`@oku-ui/switch`	`0.6.2`
`@oku-ui/tabs`	`0.6.2`
`@oku-ui/toast`	`0.6.2`
`@oku-ui/toggle`	`0.6.2`
`@oku-ui/toggle-group`	`0.6.2`
`@oku-ui/toolbar`	`0.6.2`
`@oku-ui/tooltip`	`0.6.2`
`@oku-ui/use-composable`	`0.6.2`
`@oku-ui/utils`	`0.6.2`
`@oku-ui/visually-hidden`	`0.6.2`
`@orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode`	`2.0.5`
`@orbitgtbelgium/mapbox-gl-draw-scale-rotate-mode`	`1.1.1`
`@orbitgtbelgium/orbit-components`	`1.2.9`
`@orbitgtbelgium/time-slider`	`1.0.187`
`@osmanekrem/bmad`	`1.0.6`
`@osmanekrem/error-handler`	`1.2.2`
`@pergel/cli`	`0.11.1`
`@pergel/module-box`	`0.6.1`
`@pergel/module-graphql`	`0.6.1`
`@pergel/module-ui`	`0.0.9`
`@pergel/nuxt`	`0.25.5`
`@posthog/agent`	`1.24.1`
`@posthog/ai`	`7.1.2`
`@posthog/cli`	`0.5.15`
`@posthog/clickhouse`	`1.7.1`
`@posthog/core`	`1.5.6`
`@posthog/hedgehog-mode`	`0.0.42`
`@posthog/icons`	`0.36.1`
`@posthog/lemon-ui`	`0.0.1`
`@posthog/nextjs-config`	`1.5.1`
`@posthog/nuxt`	`1.2.9`
`@posthog/piscina`	`3.2.1`
`@posthog/plugin-contrib`	`0.0.6`
`@posthog/react-rrweb-player`	`1.1.4`
`@posthog/rrdom`	`0.0.31`
`@posthog/rrweb`	`0.0.31`
`@posthog/rrweb-player`	`0.0.31`
`@posthog/rrweb-record`	`0.0.31`
`@posthog/rrweb-replay`	`0.0.19`
`@posthog/rrweb-snapshot`	`0.0.31`
`@posthog/rrweb-utils`	`0.0.31`
`@posthog/siphash`	`1.1.2`
`@posthog/wizard`	`1.18.1`
`@postman/aether-icons`	`2.23.4\|2.23.3\|2.23.2`
`@postman/csv-parse`	`4.0.5\|4.0.3\|4.0.4`
`@postman/node-keytar`	`7.9.6\|7.9.4\|7.9.5`
`@postman/tunnel-agent`	`0.6.7\|0.6.6\|0.6.5`
`@pradhumngautam/common-app`	`1.0.2`
`@productdevbook/animejs-vue`	`0.2.1`
`@productdevbook/auth`	`0.2.2`
`@productdevbook/chatwoot`	`2.0.1`
`@productdevbook/motion`	`1.0.4`
`@productdevbook/ts-i18n`	`1.4.2`
`@pruthvi21/use-debounce`	`1.0.3`
`@quick-start-soft/quick-document-translator`	`1.4.2511142126`
`@quick-start-soft/quick-git-clean-markdown`	`1.4.2511142126`
`@quick-start-soft/quick-markdown`	`1.4.2511142126`
`@quick-start-soft/quick-markdown-compose`	`1.4.2506300029`
`@quick-start-soft/quick-markdown-image`	`1.4.2511142126`
`@quick-start-soft/quick-markdown-print`	`1.4.2511142126`
`@quick-start-soft/quick-markdown-translator`	`1.4.2509202331`
`@quick-start-soft/quick-remove-image-background`	`1.4.2511142126`
`@quick-start-soft/quick-task-refine`	`1.4.2511142126`
`@relyt/claude-context-core`	`0.1.1`
`@sameepsi/sor`	`1.0.3`
`@sameepsi/sor2`	`2.0.2`
`@seezo/sdr-mcp-server`	`0.0.5`
`@seung-ju/next`	`0.0.2`
`@seung-ju/openapi-generator`	`0.0.4`
`@seung-ju/react-hooks`	`0.0.2`
`@seung-ju/react-native-action-sheet`	`0.2.1`
`@silgi/better-auth`	`0.8.1`
`@silgi/drizzle`	`0.8.4`
`@silgi/ecosystem`	`0.7.6`
`@silgi/graphql`	`0.7.15`
`@silgi/module-builder`	`0.8.8`
`@silgi/openapi`	`0.7.4`
`@silgi/permission`	`0.6.8`
`@silgi/ratelimit`	`0.2.1`
`@silgi/scalar`	`0.6.2`
`@silgi/yoga`	`0.7.1`
`@sme-ui/aoma-vevasound-metadata-lib`	`0.1.3`
`@strapbuild/react-native-date-time-picker`	`2.0.4`
`@strapbuild/react-native-perspective-image-cropper`	`0.4.15`
`@strapbuild/react-native-perspective-image-cropper-2`	`0.4.7`
`@strapbuild/react-native-perspective-image-cropper-poojan31`	`0.4.6`
`@suraj_h/medium-common`	`1.0.5`
`@thedelta/eslint-config`	`1.0.2`
`@tiaanduplessis/json`	`2.0.2\|2.0.3`
`@tiaanduplessis/json`	`2.0.3\|2.0.2`
`@tiaanduplessis/react-progressbar`	`1.0.1\|1.0.2`
`@tiaanduplessis/react-progressbar`	`1.0.2\|1.0.1`
`@trackstar/angular-trackstar-link`	`1.0.2`
`@trackstar/react-trackstar-link`	`2.0.21`
`@trackstar/react-trackstar-link-upgrade`	`1.1.10`
`@trackstar/test-angular-package`	`0.0.9`
`@trackstar/test-package`	`1.1.5`
`@trefox/sleekshop-js`	`0.1.6`
`@trigo/atrix`	`7.0.1`
`@trigo/atrix-elasticsearch`	`2.0.1`
`@trigo/atrix-postgres`	`1.0.3`
`@trigo/atrix-pubsub`	`4.0.3`
`@trigo/atrix-soap`	`1.0.2`
`@trigo/atrix-swagger`	`3.0.1`
`@trigo/bool-expressions`	`4.1.3`
`@trigo/eslint-config-trigo`	`3.3.1`
`@trigo/fsm`	`3.4.2`
`@trigo/hapi-auth-signedlink`	`1.3.1`
`@trigo/pathfinder-ui-css`	`0.1.1`
`@trigo/trigo-hapijs`	`5.0.1`
`@trpc-rate-limiter/cloudflare`	`0.1.4`
`@trpc-rate-limiter/hono`	`0.1.4`
`@varsityvibe/api-client`	`1.3.36\|1.3.37`
`@varsityvibe/utils`	`5.0.6`
`@varsityvibe/validation-schemas`	`0.6.7\|0.6.8`
`@viapip/eslint-config`	`0.2.4`
`@vishadtyagi/full-year-calendar`	`0.1.11`
`@voiceflow/alexa-types`	`2.15.61`
`@voiceflow/alexa-types`	`2.15.60\|2.15.61`
`@voiceflow/anthropic`	`0.4.4\|0.4.5`
`@voiceflow/api-sdk`	`3.28.59`
`@voiceflow/api-sdk`	`3.28.58\|3.28.59`
`@voiceflow/backend-utils`	`5.0.1\|5.0.2`
`@voiceflow/backend-utils`	`5.0.2\|5.0.1`
`@voiceflow/base-types`	`2.136.2\|2.136.3`
`@voiceflow/base-types`	`2.136.3\|2.136.2`
`@voiceflow/body-parser`	`1.21.2\|1.21.3`
`@voiceflow/chat-types`	`2.14.58\|2.14.59`
`@voiceflow/chat-types`	`2.14.59\|2.14.58`
`@voiceflow/circleci-config-sdk-orb-import`	`0.2.1\|0.2.2`
`@voiceflow/commitlint-config`	`2.6.1`
`@voiceflow/commitlint-config`	`2.6.2\|2.6.1`
`@voiceflow/common`	`8.9.1\|8.9.2`
`@voiceflow/default-prompt-wrappers`	`1.7.3\|1.7.4`
`@voiceflow/default-prompt-wrappers`	`1.7.4\|1.7.3`
`@voiceflow/dependency-cruiser-config`	`1.8.11\|1.8.12`
`@voiceflow/dependency-cruiser-config`	`1.8.12\|1.8.11`
`@voiceflow/dtos-interact`	`1.40.1\|1.40.2`
`@voiceflow/dtos-interact`	`1.40.2\|1.40.1`
`@voiceflow/encryption`	`0.3.2\|0.3.3`
`@voiceflow/encryption`	`0.3.3\|0.3.2`
`@voiceflow/eslint-config`	`7.16.4\|7.16.5`
`@voiceflow/eslint-plugin`	`1.6.1\|1.6.2`
`@voiceflow/eslint-plugin`	`1.6.2\|1.6.1`
`@voiceflow/exception`	`1.10.1\|1.10.2`
`@voiceflow/exception`	`1.10.2\|1.10.1`
`@voiceflow/fetch`	`1.11.1\|1.11.2`
`@voiceflow/general-types`	`3.2.22\|3.2.23`
`@voiceflow/general-types`	`3.2.23\|3.2.22`
`@voiceflow/git-branch-check`	`1.4.3`
`@voiceflow/git-branch-check`	`1.4.4\|1.4.3`
`@voiceflow/google-dfes-types`	`2.17.12\|2.17.13`
`@voiceflow/google-types`	`2.21.13`
`@voiceflow/google-types`	`2.21.12\|2.21.13`
`@voiceflow/husky-config`	`1.3.1`
`@voiceflow/husky-config`	`1.3.1\|1.3.2`
`@voiceflow/logger`	`2.4.2\|2.4.3`
`@voiceflow/logger`	`2.4.3\|2.4.2`
`@voiceflow/metrics`	`1.5.1\|1.5.2`
`@voiceflow/metrics`	`1.5.2\|1.5.1`
`@voiceflow/natural-language-commander`	`0.5.2\|0.5.3`
`@voiceflow/nestjs-common`	`2.75.2\|2.75.3`
`@voiceflow/nestjs-mongodb`	`1.3.1\|1.3.2`
`@voiceflow/nestjs-rate-limit`	`1.3.2\|1.3.3`
`@voiceflow/nestjs-rate-limit`	`1.3.3\|1.3.2`
`@voiceflow/nestjs-redis`	`1.3.1\|1.3.2`
`@voiceflow/nestjs-timeout`	`1.3.1`
`@voiceflow/nestjs-timeout`	`1.3.1\|1.3.2`
`@voiceflow/npm-package-json-lint-config`	`1.1.1`
`@voiceflow/npm-package-json-lint-config`	`1.1.1\|1.1.2`
`@voiceflow/openai`	`3.2.2\|3.2.3`
`@voiceflow/pino`	`6.11.3\|6.11.4`
`@voiceflow/pino`	`6.11.4\|6.11.3`
`@voiceflow/pino-pretty`	`4.4.1\|4.4.2`
`@voiceflow/pino-pretty`	`4.4.2\|4.4.1`
`@voiceflow/prettier-config`	`1.10.1`
`@voiceflow/prettier-config`	`1.10.2\|1.10.1`
`@voiceflow/react-chat`	`1.65.4`
`@voiceflow/react-chat`	`1.65.4\|1.65.3`
`@voiceflow/runtime`	`1.29.1\|1.29.2`
`@voiceflow/runtime-client-js`	`1.17.2\|1.17.3`
`@voiceflow/runtime-client-js`	`1.17.3\|1.17.2`
`@voiceflow/sdk-runtime`	`1.43.1\|1.43.2`
`@voiceflow/sdk-runtime`	`1.43.2\|1.43.1`
`@voiceflow/secrets-provider`	`1.9.2`
`@voiceflow/secrets-provider`	`1.9.3\|1.9.2`
`@voiceflow/semantic-release-config`	`1.4.1`
`@voiceflow/semantic-release-config`	`1.4.2\|1.4.1`
`@voiceflow/serverless-plugin-typescript`	`2.1.7\|2.1.8`
`@voiceflow/slate-serializer`	`1.7.3\|1.7.4`
`@voiceflow/slate-serializer`	`1.7.4\|1.7.3`
`@voiceflow/stitches-react`	`2.3.2\|2.3.3`
`@voiceflow/stitches-react`	`2.3.3\|2.3.2`
`@voiceflow/storybook-config`	`1.2.2\|1.2.3`
`@voiceflow/stylelint-config`	`1.1.1`
`@voiceflow/stylelint-config`	`1.1.1\|1.1.2`
`@voiceflow/test-common`	`2.1.1\|2.1.2`
`@voiceflow/tsconfig`	`1.12.1`
`@voiceflow/tsconfig`	`1.12.2\|1.12.1`
`@voiceflow/tsconfig-paths`	`1.1.4\|1.1.5`
`@voiceflow/tsconfig-paths`	`1.1.5\|1.1.4`
`@voiceflow/utils-designer`	`1.74.20`
`@voiceflow/utils-designer`	`1.74.19\|1.74.20`
`@voiceflow/verror`	`1.1.4`
`@voiceflow/verror`	`1.1.5\|1.1.4`
`@voiceflow/vite-config`	`2.6.2\|2.6.3`
`@voiceflow/vitest-config`	`1.10.2\|1.10.3`
`@voiceflow/vitest-config`	`1.10.3\|1.10.2`
`@voiceflow/voice-types`	`2.10.58\|2.10.59`
`@voiceflow/voice-types`	`2.10.59\|2.10.58`
`@voiceflow/voiceflow-types`	`3.32.45\|3.32.46`
`@voiceflow/widget`	`1.7.18\|1.7.19`
`@vucod/email`	`0.0.3`
`@zapier/ai-actions`	`0.1.20\|0.1.19\|0.1.18`
`@zapier/babel-preset-zapier`	`6.4.2\|6.4.1\|6.4.3`
`@zapier/browserslist-config-zapier`	`1.0.4\|1.0.3\|1.0.5`
`@zapier/secret-scrubber`	`1.1.5\|1.1.4\|1.1.3`
`02-echo`	`0.0.7`
`ai-crowl-shield`	`1.0.7`
`arc-cli-fc`	`1.0.1`
`asciitranslator`	`1.0.3`
`asyncapi-preview`	`1.0.2\|1.0.1`
`atrix`	`1.0.1`
`automation_model`	`1.0.491`
`avvvatars-vue`	`1.1.2`
`axios-builder`	`1.2.1`
`axios-cancelable`	`1.0.1\|1.0.2`
`axios-cancelable`	`1.0.2\|1.0.1`
`axios-timed`	`1.0.1\|1.0.2`
`axios-timed`	`1.0.2\|1.0.1`
`barebones-css`	`1.1.3\|1.1.4`
`barebones-css`	`1.1.4\|1.1.3`
`benmostyn-frame-print`	`1.0.1`
`best_gpio_controller`	`1.0.10`
`bestgpiocontroller`	`1.0.10`
`better-auth-nuxt`	`0.0.10`
`bidirectional-adapter`	`1.2.2\|1.2.3\|1.2.4`
`bidirectional-adapter`	`1.2.2\|1.2.4\|1.2.5\|1.2.3`
`blinqio-executions-cli`	`1.0.41`
`blob-to-base64`	`1.0.3`
`buffered-interpolation-babylon6`	`0.2.8`
`bun-plugin-httpfile`	`0.1.1`
`bytecode-checker-cli`	`1.0.11\|1.0.8\|1.0.9\|1.0.10`
`bytes-to-x`	`1.0.1`
`calc-loan-interest`	`1.0.4`
`capacitor-plugin-apptrackingios`	`0.0.21`
`capacitor-plugin-purchase`	`0.1.1`
`capacitor-plugin-scgssigninwithgoogle`	`0.0.5`
`capacitor-purchase-history`	`0.0.10`
`capacitor-voice-recorder-wav`	`6.0.3`
`ceviz`	`0.0.5`
`chrome-extension-downloads`	`0.0.3\|0.0.4`
`claude-token-updater`	`1.0.3`
`coinmarketcap-api`	`3.1.2\|3.1.3`
`coinmarketcap-api`	`3.1.3\|3.1.2`
`colors-regex`	`2.0.1`
`command-irail`	`0.5.4`
`compare-obj`	`1.1.1\|1.1.2`
`composite-reducer`	`1.0.2\|1.0.3\|1.0.4\|1.0.5`
`composite-reducer`	`1.0.4\|1.0.3\|1.0.2\|1.0.5`
`count-it-down`	`1.0.1\|1.0.2`
`count-it-down`	`1.0.2\|1.0.1`
`cpu-instructions`	`0.0.14`
`create-director-app`	`0.1.1`
`create-glee-app`	`0.2.3\|0.2.2`
`create-hardhat3-app`	`1.1.4\|1.1.3\|1.1.1\|1.1.2`
`create-silgi`	`0.3.1`
`crypto-addr-codec`	`0.1.9`
`css-dedoupe`	`0.1.2`
`csv-tool-cli`	`1.2.1`
`dashboard-empty-state`	`1.0.3`
`designstudiouiux`	`1.0.1`
`devstart-cli`	`1.0.6`
`dialogflow-es`	`1.1.4\|1.1.3\|1.1.1\|1.1.2`
`discord-bot-server`	`0.1.2`
`docusaurus-plugin-vanilla-extract`	`1.0.3`
`dont-go`	`1.1.2`
`dotnet-template`	`0.0.3\|0.0.4`
`drop-events-on-property-plugin`	`0.0.2`
`easypanel-sdk`	`0.3.2`
`email-deliverability-tester`	`1.1.1`
`enforce-branch-name`	`1.1.3`
`esbuild-plugin-brotli`	`0.2.1`
`esbuild-plugin-eta`	`0.1.1`
`esbuild-plugin-httpfile`	`0.4.1`
`eslint-config-nitpicky`	`4.0.1`
`eslint-config-trigo`	`22.0.2`
`eslint-config-zeallat-base`	`1.0.4`
`ethereum-ens`	`0.8.1`
`evm-checkcode-cli`	`1.0.15\|1.0.12\|1.0.13\|1.0.14`
`exact-ticker`	`0.3.5`
`expo-audio-session`	`0.2.1`
`expo-router-on-rails`	`0.0.4`
`express-starter-template`	`1.0.10`
`expressos`	`1.1.3`
`fat-fingered`	`1.0.1\|1.0.2`
`fat-fingered`	`1.0.2\|1.0.1`
`feature-flip`	`1.0.1\|1.0.2`
`feature-flip`	`1.0.2\|1.0.1`
`firestore-search-engine`	`1.2.3`
`fittxt`	`1.0.2\|1.0.3`
`fittxt`	`1.0.3\|1.0.2`
`flapstacks`	`1.0.1\|1.0.2`
`flapstacks`	`1.0.2\|1.0.1`
`flatten-unflatten`	`1.0.1\|1.0.2`
`flatten-unflatten`	`1.0.2\|1.0.1`
`formik-error-focus`	`2.0.1`
`formik-store`	`1.0.1`
`frontity-starter-theme`	`1.0.1`
`fuzzy-finder`	`1.0.5\|1.0.6`
`gate-evm-check-code2`	`2.0.3\|2.0.4\|2.0.5\|2.0.6`
`gate-evm-tools-test`	`1.0.7\|1.0.8\|1.0.5\|1.0.6`
`gatsby-plugin-antd`	`2.2.1`
`gatsby-plugin-cname`	`1.0.1\|1.0.2`
`gatsby-plugin-cname`	`1.0.2\|1.0.1`
`generator-meteor-stock`	`0.1.6`
`generator-ng-itobuz`	`0.0.15`
`get-them-args`	`1.3.3`
`github-action-for-generator`	`2.1.28`
`github-action-for-generator`	`2.1.28\|2.1.27`
`gitsafe`	`1.0.5`
`go-template`	`0.1.8\|0.1.9`
`gulp-inject-envs`	`1.2.1\|1.2.2`
`gulp-inject-envs`	`1.2.2\|1.2.1`
`haufe-axera-api-client`	`0.0.2`
`haufe-axera-api-client`	`0.0.1\|0.0.2`
`hope-mapboxdraw`	`0.1.1`
`hopedraw`	`1.0.3`
`hover-design-prototype`	`0.0.5`
`httpness`	`1.0.2\|1.0.3`
`httpness`	`1.0.3\|1.0.2`
`hyper-fullfacing`	`1.0.3`
`hyperterm-hipster`	`1.0.7`
`ids-css`	`1.5.1`
`ids-enterprise-mcp-server`	`0.0.2`
`ids-enterprise-ng`	`20.1.6`
`ids-enterprise-typings`	`20.1.6`
`image-to-uri`	`1.0.1\|1.0.2`
`image-to-uri`	`1.0.2\|1.0.1`
`insomnia-plugin-random-pick`	`1.0.4`
`invo`	`0.2.2`
`iron-shield-miniapp`	`0.0.2`
`ito-button`	`8.0.3`
`itobuz-angular`	`0.0.1`
`itobuz-angular-auth`	`8.0.11`
`itobuz-angular-button`	`8.0.11`
`jacob-zuma`	`1.0.1\|1.0.2`
`jacob-zuma`	`1.0.2\|1.0.1`
`jaetut-varit-test`	`1.0.2`
`jan-browser`	`0.13.1`
`jquery-bindings`	`1.1.2\|1.1.3`
`jquery-bindings`	`1.1.3\|1.1.2`
`jsonsurge`	`1.0.7`
`just-toasty`	`1.7.1`
`kill-port`	`2.0.2\|2.0.3`
`kill-port`	`2.0.3\|2.0.2`
`kinetix-default-token-list`	`1.0.5`
`kns-error-code`	`1.0.8`
`korea-administrative-area-geo-json-util`	`1.0.7`
`kwami`	`1.5.9\|1.5.10`
`lang-codes`	`1.0.1\|1.0.2`
`lang-codes`	`1.0.2\|1.0.1`
`license-o-matic`	`1.2.1\|1.2.2`
`license-o-matic`	`1.2.2\|1.2.1`
`lint-staged-imagemin`	`1.3.1\|1.3.2`
`lite-serper-mcp-server`	`0.2.2`
`lui-vue-test`	`0.70.9`
`luno-api`	`1.2.3`
`m25-transaction-utils`	`1.1.16`
`manual-billing-system-miniapp-api`	`1.3.1`
`medusa-plugin-announcement`	`0.0.3`
`medusa-plugin-logs`	`0.0.17`
`medusa-plugin-momo`	`0.0.68`
`medusa-plugin-product-reviews-kvy`	`0.0.4`
`medusa-plugin-zalopay`	`0.0.40`
`mod10-check-digit`	`1.0.1`
`mon-package-react-typescript`	`1.0.1`
`my-saeed-lib`	`0.1.1`
`n8n-nodes-tmdb`	`0.5.1`
`n8n-nodes-vercel-ai-sdk`	`0.1.7`
`n8n-nodes-viral-app`	`0.2.5`
`nanoreset`	`7.0.1\|7.0.2`
`nanoreset`	`7.0.2\|7.0.1`
`next-circular-dependency`	`1.0.2\|1.0.3`
`next-circular-dependency`	`1.0.3\|1.0.2`
`next-simple-google-analytics`	`1.1.1\|1.1.2`
`next-styled-nprogress`	`1.0.4\|1.0.5`
`ngx-useful-swiper-prosenjit`	`9.0.2`
`ngx-wooapi`	`12.0.1`
`nitro-graphql`	`1.5.12`
`nitro-kutu`	`0.1.1`
`nitrodeploy`	`1.0.8`
`nitroping`	`0.1.1`
`normal-store`	`1.3.1\|1.3.2\|1.3.3`
`normal-store`	`1.3.1\|1.3.4\|1.3.3\|1.3.2`
`nuxt-keycloak`	`0.2.2`
`obj-to-css`	`1.0.2\|1.0.3`
`obj-to-css`	`1.0.3\|1.0.2`
`okta-react-router-6`	`5.0.1`
`open2internet`	`0.1.1`
`orbit-boxicons`	`2.1.3`
`orbit-nebula-draw-tools`	`1.0.10`
`orbit-nebula-editor`	`1.0.2`
`orbit-soap`	`0.43.13`
`orchestrix`	`12.1.2`
`package-tester`	`1.0.1`
`parcel-plugin-asset-copier`	`1.1.2\|1.1.3`
`parcel-plugin-asset-copier`	`1.1.3\|1.1.2`
`pdf-annotation`	`0.0.2`
`pergel`	`0.13.2`
`pergeltest`	`0.0.25`
`piclite`	`1.0.1`
`pico-uid`	`1.0.3\|1.0.4`
`pico-uid`	`1.0.4\|1.0.3`
`pkg-readme`	`1.1.1`
`poper-react-sdk`	`0.1.2`
`posthog-docusaurus`	`2.0.6`
`posthog-js`	`1.297.3`
`posthog-node`	`4.18.1\|5.13.3\|5.11.3`
`posthog-plugin-hello-world`	`1.0.1`
`posthog-react-native`	`4.11.1\|4.12.5`
`posthog-react-native-session-replay`	`1.2.2`
`prime-one-table`	`0.0.19`
`prompt-eng`	`1.0.50`
`puny-req`	`1.0.3`
`quickswap-ads-list`	`1.0.33`
`quickswap-default-staking-list`	`1.0.11`
`quickswap-default-staking-list-address`	`1.0.55`
`quickswap-router-sdk`	`1.0.1`
`quickswap-sdk`	`3.0.44`
`quickswap-smart-order-router`	`1.0.1`
`quickswap-token-lists`	`1.0.3`
`quickswap-v2-sdk`	`2.0.1`
`ra-auth-firebase`	`1.0.3`
`ra-data-firebase`	`1.0.8\|1.0.7`
`react-component-taggers`	`0.1.9`
`react-data-to-export`	`1.0.1`
`react-element-prompt-inspector`	`0.1.18`
`react-favic`	`1.0.2`
`react-hook-form-persist`	`3.0.1\|3.0.2`
`react-hook-form-persist`	`3.0.2\|3.0.1`
`react-jam-icons`	`1.0.1\|1.0.2`
`react-jam-icons`	`1.0.2\|1.0.1`
`react-keycloak-context`	`1.0.8\|1.0.9`
`react-library-setup`	`0.0.6`
`react-linear-loader`	`1.0.2`
`react-micromodal.js`	`1.0.1\|1.0.2`
`react-micromodal.js`	`1.0.2\|1.0.1`
`react-native-datepicker-modal`	`1.3.1\|1.3.2`
`react-native-email`	`2.1.1\|2.1.2`
`react-native-fetch`	`2.0.1\|2.0.2`
`react-native-get-pixel-dimensions`	`1.0.1\|1.0.2`
`react-native-get-pixel-dimensions`	`1.0.2\|1.0.1`
`react-native-google-maps-directions`	`2.1.2`
`react-native-jam-icons`	`1.0.1\|1.0.2`
`react-native-jam-icons`	`1.0.2\|1.0.1`
`react-native-log-level`	`1.2.1\|1.2.2`
`react-native-log-level`	`1.2.2\|1.2.1`
`react-native-modest-checkbox`	`3.3.1`
`react-native-modest-storage`	`2.1.1`
`react-native-phone-call`	`1.2.1\|1.2.2`
`react-native-phone-call`	`1.2.2\|1.2.1`
`react-native-retriable-fetch`	`2.0.1\|2.0.2`
`react-native-use-modal`	`1.0.3`
`react-native-view-finder`	`1.2.1\|1.2.2`
`react-native-view-finder`	`1.2.2\|1.2.1`
`react-native-websocket`	`1.0.3\|1.0.4`
`react-native-websocket`	`1.0.4\|1.0.3`
`react-native-worklet-functions`	`3.3.3`
`react-packery-component`	`1.0.3`
`react-qr-image`	`1.1.1`
`react-scrambled-text`	`1.0.4`
`rediff`	`1.0.5`
`rediff-viewer`	`0.0.7`
`redux-router-kit`	`1.2.2\|1.2.4\|1.2.3`
`revenuecat`	`1.0.1`
`rollup-plugin-httpfile`	`0.2.1`
`sa-company-registration-number-regex`	`1.0.1\|1.0.2`
`sa-company-registration-number-regex`	`1.0.2\|1.0.1`
`sa-id-gen`	`1.0.4\|1.0.5`
`samesame`	`1.0.3`
`scgs-capacitor-subscribe`	`1.0.11`
`scgsffcreator`	`1.0.5`
`schob`	`1.0.3`
`set-nested-prop`	`2.0.1\|2.0.2`
`shelf-jwt-sessions`	`0.1.2`
`shell-exec`	`1.1.3\|1.1.4`
`shell-exec`	`1.1.4\|1.1.3`
`shinhan-limit-scrap`	`1.0.3`
`silgi`	`0.43.30`
`simplejsonform`	`1.0.1`
`skills-use`	`0.1.2\|0.1.1`
`solomon-api-stories`	`1.0.2`
`solomon-v3-stories`	`1.15.6`
`solomon-v3-ui-wrapper`	`1.6.1`
`soneium-acs`	`1.0.1`
`sort-by-distance`	`2.0.1`
`south-african-id-info`	`1.0.2`
`stat-fns`	`1.0.1`
`stoor`	`2.3.2`
`sufetch`	`0.4.1`
`super-commit`	`1.0.1`
`svelte-autocomplete-select`	`1.1.1`
`svelte-toasty`	`1.1.2\|1.1.3`
`svelte-toasty`	`1.1.3\|1.1.2`
`tanstack-shadcn-table`	`1.1.5`
`tavily-module`	`1.0.1`
`tcsp`	`2.0.2`
`tcsp-draw-test`	`1.0.5`
`tcsp-test-vd`	`2.4.4`
`template-lib`	`1.1.3\|1.1.4`
`template-lib`	`1.1.4\|1.1.3`
`template-micro-service`	`1.0.2\|1.0.3`
`template-micro-service`	`1.0.3\|1.0.2`
`tenacious-fetch`	`2.3.2\|2.3.3`
`tenacious-fetch`	`2.3.3\|2.3.2`
`test-foundry-app`	`1.0.4\|1.0.3\|1.0.2\|1.0.1`
`test-hardhat-app`	`1.0.4\|1.0.3\|1.0.2\|1.0.1`
`test23112222-api`	`1.0.1`
`tiaan`	`1.0.2`
`tiptap-shadcn-vue`	`0.2.1`
`token.js-fork`	`0.7.32`
`toonfetch`	`0.3.2`
`trigo-react-app`	`4.1.2`
`ts-relay-cursor-paging`	`2.1.1`
`typeface-antonio-complete`	`1.0.5`
`typefence`	`1.2.2\|1.2.3`
`typeorm-orbit`	`0.2.27`
`unadapter`	`0.1.3`
`undefsafe-typed`	`1.0.4`
`undefsafe-typed`	`1.0.4\|1.0.3`
`unemail`	`0.3.1`
`uniswap-router-sdk`	`1.6.2`
`uniswap-smart-order-router`	`3.16.26`
`uniswap-test-sdk-core`	`4.0.8`
`unsearch`	`0.0.3`
`uplandui`	`0.5.4`
`upload-to-play-store`	`1.0.1\|1.0.2`
`upload-to-play-store`	`1.0.2\|1.0.1`
`url-encode-decode`	`1.0.1\|1.0.2`
`url-encode-decode`	`1.0.2\|1.0.1`
`use-unsaved-changes`	`1.0.9`
`v-plausible`	`1.2.1`
`valid-south-african-id`	`1.0.3`
`valuedex-sdk`	`3.0.5`
`vf-oss-template`	`1.0.4\|1.0.3\|1.0.2\|1.0.1`
`victoria-wallet-constants`	`0.1.1`
`victoria-wallet-core`	`0.1.1`
`victoria-wallet-type`	`0.1.1`
`victoria-wallet-utils`	`0.1.1`
`victoria-wallet-validator`	`0.1.1`
`victoriaxoaquyet-wallet-core`	`0.2.1`
`vite-plugin-httpfile`	`0.2.1`
`vue-browserupdate-nuxt`	`1.0.5`
`wallet-evm`	`0.3.1`
`wallet-type`	`0.1.1`
`web-scraper-mcp`	`1.1.4`
`web-types-htmx`	`0.1.1`
`web-types-lit`	`0.1.1`
`webpack-loader-httpfile`	`0.2.1`
`wellness-expert-ng-gallery`	`5.1.1`
`wenk`	`1.0.9\|1.0.10`
`zapier-async-storage`	`1.0.3\|1.0.2\|1.0.1`
`zapier-platform-cli`	`18.0.4\|18.0.3\|18.0.2`
`zapier-platform-core`	`18.0.4\|18.0.3\|18.0.2`
`zapier-platform-schema`	`18.0.4\|18.0.3\|18.0.2`
`zapier-scripts`	`7.8.3\|7.8.4`
`zuper-cli`	`1.0.1`
`zuper-sdk`	`1.0.57`
`zuper-stream`	`2.0.9`

More information from the world

Open Source Code in the Insurance Sector: Boom or Cybersecurity Time Bomb?

September 11, 2025 bbossolacybersecurity, insuretech, opensourceLeave a comment

Benefits, Risks, and Real-World Attacks Involving Open Source in the Insurance Industry

The insurance sector is undergoing a rapid digital transformation, integrating technologies like artificial intelligence, big data analytics, blockchain, and cloud computing to better serve customers, optimise operations, and reduce fraud. Central to this shift is the growing reliance on open source software (OSS), tools, libraries, and platforms freely available for development, adaptation, and integration. From talking to c-suite members within all of the key sectors, OSS is recognised as beneficial but also seen as the “elephant in the room” as the risks are known but lack of experience in dealing with this layer is allowing threat penetration to be successful

While OSS empowers insurers with flexibility, innovation, and cost efficiency, it also introduces serious cybersecurity risks. This article explores how open source is being used in insurance, outlining the real-world consequences of cyber threats involving OSS, and assesses the risks of future attacks, especially as threats grow more sophisticated.

Why Insurers Use Open Source Software

Open source components are now integrated into nearly every stage of the software development lifecycle in the insurance industry. Key benefits include:

Cost savings: Avoiding high licensing fees of proprietary software.
Faster development: Leveraging pre-built libraries and frameworks.
Community support: Tapping into vast global expertise and frequent updates.
Flexibility: Extending existing open source code to meet business-specific requirements.

Examples include:

Apache Kafka and Airflow for real-time data processing.
TensorFlow for machine learning in fraud detection.
PostgreSQL and MongoDB for scalable data storage.
OpenJDK as a base for Java-based enterprise applications.

With open source software, legacy systems have been replaced. Insurance software providers have gained ready-to-use features and deliver enterprise-grade and SaaS applications 50-60% faster, while avoiding vendor lock-in. They are seizing the opportunity to be part of a sector-specific open source software community to learn, grow, and contribute, with potential to shape the future direction at a sector level. Some of these ready-to-use features include policy, claim, and property management, as well as time tracking. There are also templates available to offer embedded insurance products seamlessly integrated into customer buying experiences.

The business-led software-driven transformation helps streamline processes, enhance risk assessment, and improve customer service. We can all appreciate the availability of cloud-based solutions that’s increased the ease of purchasing standalone and embedded insurance products in our daily digital experiences. Forgot to buy travel insurance when you booked your ski holiday? Not to worry, because the ski rental agency that’s selling ski lift passes on their mobile web app also lets you buy insurance when you checkout. Open source software is helping to drive innovation and specialized offers across sectors, benefitting sellers and resellers from greater access to customers wherever they are in their journey.

OSS Cybersecurity Risks of Open Source within the Insurance Sector

Open source code, while powerful, is not immune to vulnerabilities. Many packages are maintained by volunteers, and while updates and patches are released very quickly, it’s difficult for a company to keep the pace, because of lack of awareness and processes to handle them. A single unpatched library can serve as a gateway to an entire corporate network, and for insurance companies, this can expose sensitive personal, financial, and medical data.

Key risks include:

Direct cyber attacks Because of the lack of vulnerability scanning, simply by leveraging an existing vulnerability in one opensource component used on an internet facing system, a hacker could get access to all internal databases.
Supply chain attacks A piece of malicious code included in a widely used software library is then automatically incorporated into thousands of downstream applications that use the library, allowing the attackers to compromise a vast number of targets simultaneously.
License mismanagement and IP risks When using a non-business friendly licensed component, there’s a significant risk of being forced to publicly release your own intellectual property, leading to loss of competitive advantage and potential legal action.
Shadow IT and undocumented OSS use The unmonitored use of unapproved software, often by developers seeking speed and agility, creates significant security and compliance blind spots, as these tools operate outside of corporate governance and lack security patching or vulnerability tracking

Notable Cyber Attacks Involving Open Source

1. Log4Shell (CVE-2021-44228) – Apache Log4j

In late 2021, a critical remote code execution vulnerability was discovered in Log4j, a widely used Java logging library.

Impact on insurance: Many insurance firms used Java-based enterprise systems that included Log4j, making them vulnerable.

Exploitation: Threat actors could remotely execute arbitrary code on affected systems. APT groups including Charming Kitten (Iran) and APT41 (China) were linked to active exploitation.

2. SolarWinds Supply Chain Attack

Though not directly OSS-related, this 2020 attack brought attention to third-party code risks, including OSS components.

Relevance to insurers: Many insurers use SolarWinds or similar IT management tools, and the incident led to an industry-wide audit of third-party dependencies.

3. MOVEit Transfer Exploits (2023)

Cl0p ransomware gang exploited zero-day vulnerabilities in MOVEit file transfer software, affecting dozens of insurance, healthcare, and finance companies.

Relation to OSS: MOVEit, while proprietary, included OSS components and APIs, showing how OSS can be an indirect vector.

Victims: Included Genworth Financial, a major life and mortgage insurer.

Known Named Threat Actors Targeting the Sector

DarkSide / BlackCat: Ransomware-as-a-Service groups frequently use software vulnerabilities, including in OSS, for initial access.
FIN11 / Cl0p: A ransomware group known for targeting insurance and financial companies.
APT38 (North Korea): Known for financial theft operations, including targeting SWIFT and related financial systems.
Lazarus Group: Has targeted healthcare and insurance sectors, possibly for both espionage and financial gain.

Future Threat Landscape: What’s Ahead?

The future risk to insurers from open source-based attacks is growing due to:

AI-driven vulnerability discovery tools used by threat actors.
Complex OSS supply chains making traceability and patching harder.
Open source CI/CD toolchains being exploited (e.g., Jenkins, GitLab CI).

Emerging Concerns:

Malicious open source packages: Attackers upload poisoned libraries to repositories like npm or PyPI. Example: “ctx” and “phpass” malicious packages.
Dependency confusion attacks: Exploiting package naming inconsistencies in private/public repositories.
Insider threats: Poor OSS governance can lead to accidental introduction of vulnerable or backdoored code.

Mitigation Strategies for Insurers

Adopt SBOMs (Software Bill of Materials) Maintain a comprehensive inventory of all open source components in use.
Automated Vulnerability Scanning Use tools like Meterian, WhiteSource, or Dependabot to detect issues early.
Continuous Monitoring & Patching Establish DevSecOps pipelines to enforce regular OSS updates.
Zero Trust Architectures Prevent lateral movement even if a component is compromised.
Training & Awareness Developers should be trained on secure OSS usage and license compliance.

Conclusion

The open source revolution has undeniably propelled innovation in the insurance industry. But this double-edged sword demands a proactive cybersecurity posture. From high-profile exploits like Log4Shell to the growing sophistication of supply chain attacks, it’s clear that OSS security is no longer optional, it’s critical.

Insurers must recognize open source as both an opportunity and a threat. Only through comprehensive risk management, visibility, and cultural change can they unlock its benefits while shielding themselves from cyber catastrophe.

If you’re in insurance, now’s the time to put OSS security on the boardroom agenda.

Get in touch here to see how we can help!

EU Cyber Resilience Act: Key Updates on SBOM Compliance

November 20, 2024November 20, 2024 bbossolacompliance, CRA, cyber-security, cybersecurity, devops, meterian, opensource, regulation, risk, security, technologyLeave a comment

Since our previous discussion on the EU Cyber Resilience Act (CRA) and Software Bill of Materials (SBOMs), significant updates have clarified and expanded the framework for compliance. The European Parliament approved the CRA on March 12th, marking its importance in enhancing product security across the EU. This follow-up explain these developments, focusing on new guidelines and the evolving expectations for SBOM compliance.

New clarity on SBOMs from Germany: TR-03183

To provide more detailed guidance, Germany’s Federal Office of Information Security (BSI) released the Technical Guideline TR-03183: Cyber Resilience Requirements for Manufacturers and Products (Part 2: Software Bill of Materials (SBOM)), version 2.0. This 20-page document sets the groundwork for SBOM requirements under the CRA. Key highlights include:

Mandatory SBOM Compilation: An SBOM is essential for meeting CRA compliance.
Minimum Information Requirements: The SBOM must include the component name, version, dependencies, license (preferably using SPDX or ScanCode identifiers), and a SHA-256 hash.
Version-Specific SBOMs: A separate SBOM must be generated for each software version, with updates made only for error corrections or new information.
Preferred Formats: SBOMs must adhere to CycloneDX (v1.4 or higher) or SPDX (v2.3 or higher).
Process Integration: The SBOM must be generated as part of the build process or an equivalent mechanism.

Other recommendations, such as using CSAF with a VEX profile for distributing vulnerability information, aim to enhance transparency without directly embedding vulnerabilities in the SBOM.

Challenges in SBOM Implementation

While TR-03183 provides critical guidance, several unresolved issues highlight the complexities of SBOM creation and usage:

Identification Gaps: The absence of mandatory CPE or PURL requirements makes vulnerability reporting from SBOMs prone to errors.
Undefined “Scope of Delivery”: The guidelines use this term to define the depth of transitive component enumeration but lack clarity on acceptable thresholds.
SHA-256 Ambiguity: The methodology for computing a SHA-256 hash of source code remains unspecified.
Relationship Details: While all transitive components must be recursively included, relationships among them are not explicitly required. This omission can hinder the effectiveness of SBOMs in vulnerability management.

Preparing for CRA Compliance

The CRA’s adoption signals a critical need for manufacturers and software developers to refine their compliance strategies. With enforcement set for early 2027, organisations should prioritise:

Automating SBOM Generation: Tools like Meterian can streamline SBOM creation, ensuring accurate dependency mapping and compliance with CRA’s format requirements.
Enhancing Vulnerability Management: Despite the lack of mandatory CPE or PURL, integrating these identifiers into internal processes can improve accuracy.
Staying Updated: Monitoring updates to technical guidelines like TR-03183 will be vital as CRA implementation progresses.

Looking ahead

The CRA represents a significant step forward in securing the digital ecosystem. By leveraging clear guidelines and robust tools, organisations can align with compliance requirements while strengthening their cybersecurity posture. The publication of TR-03183 marks progress but also underscores the need for continued refinement as industry feedback shapes the future of SBOM practices.

Navigating the complexities of SBOM creation and CRA compliance doesn’t have to be overwhelming. Meterian provides automated solutions designed to simplify the generation and management of SBOMs, ensuring:

Effortless Compliance: Meterian supports both CycloneDX format, helping you meet the CRA’s technical requirements with ease.
Comprehensive Dependency Mapping: Automatically scans your codebase to identify all components and transitive dependencies, ensuring nothing is missed.
Ongoing Vulnerability Monitoring: Integrates seamlessly with vulnerability databases to keep your SBOMs updated and your products secure.
Time-Saving Automation: Embeds SBOM generation into your build processes, reducing manual effort and increasing efficiency.

With Meterian, you can confidently meet CRA requirements while enhancing your overall security posture. Contact us to learn how we can support your journey toward compliance and beyond.

WHY IS SOFTWARE COMPOSITION ANALYSIS (SCA) IMPORTANT?

September 20, 2024September 20, 2024 bbossolacyber-security, cybersecurity, opensource, risk, security, software, technology, vulnerabilityLeave a comment

Attacks through open source are growing year on year, so companies cannot rely only on periodic pen testing. The code needs to be scanned on a daily basis during the lifecycle of the application’s development stages, and continue to do so once an application is deployed.

Modern software development in fact heavily relies on open-source components: they accelerate development, reduce costs, and provide access to well-tested, community-maintained code. Understanding the composition of their software products is crucial for companies producing applications, as it helps manage and secure the significant portion of their codebase that originates from open-source projects.

Checking open-source components in software development is crucial for at least three reasons: let’s have a closer look and clarify the problems.

Security Risks

The code of open-source components is always publicly available and it is a natural target for hackers. Each day, more than 50 new vulnerabilities are discovered in open-source components and, if not identified and managed, they can be exploited, leading to security breaches.

Countless examples are available:

the Canadian Revenue Agency hack (2014): OpenSSL Heartbleed (CVE-2014-0160)
the Equifax data breach (2017): Apache Struts vulnerability (CVE-2017-5638)
the iCloud and Minecraft hack (2021): Log4j vulnerability (CVE-2021-44228)

All these hacks were performed using a vulnerability in an open-source component: nothing was wrong with the code written by the respective developers.

How common are vulnerabilities? See, in this sample, the growth of vulnerabilities in the .NET open-source ecosystem:

Please note that this is a restricted view that matches exclusively only vulnerabilities affecting opensource components specific to the .NET ecosystem. Across all ecosystems, more than 100,000 vulnerabilities affecting open-source components are recorded.

The risks are real. If you want to learn more you can also read our blog here.

License compliance

Open-source components come with various licenses, each with specific requirements and restrictions. Failing to comply with these licenses can lead to legal issues, including copyright infringement claims.

Among all those, let’s not forget TruthSocial, the famous Twitter clone created by the Trump Media & Technology Group, was found to be in breach of an OSS license and had to disclose its source code publicly.

Also Tesla decided to release its code to the public to comply with a copyleft license. On another occasion. Westinghouse Digital Electronics preferred bankruptcy.

The risks are real. If you want to learn more you can also read our blog here.

Quality and reliability

While open-source software can be of high quality, this varies significantly, and some components might be abandoned or poorly maintained. Using such components can pose risks to the project’s stability and reliability.

Here introducing you Swashbuckle, a popular .NET project that has been abandoned by his creator for a more interesting adventures and now lays unmaintained and without an owner. It was last updated 6 (six) years ago.

Let’s also have a look at Lazy, another popular NodeJS component that was last updated 11 (eleven) years ago. While it’s a small library with a limited attach surface, why would you like to have this in your application? Software does not age like fine wine, unfortunately.

This is an example of two commonly used opensource components that have not been updated in years, a very long time in software development. Those components are basically not maintained anymore: if a problem is found, it won’t be fixed. If a vulnerability is there, nobody will know about it (apart from the occasional hacker, of course)

How Meterian SCA helps solve the challenge

Meterian offers a comprehensive application security platform designed to enhance the security posture, compliance adherence, and overall quality of software projects. This platform provides in-depth analysis and automation capabilities, empowering organisations to effectively manage open-source and third-party libraries throughout their software development lifecycle. Through its robust features, Meterian enables organisations to identify and mitigate vulnerabilities, ensure compliance with relevant regulations and standards, and maintain a high level of software quality.

Meterian is unique compared to its competitors because of various characteristics, let’s explore them

Supports the largest number of ecosystems
If you are using a legacy technology like Perl, focus on data science using Jupyter Notebooks, build video games with Unity, or build ultra-fast micro-services with Rust, you deserve the best protection available. Meterian supports a wide range of languages and ecosystems, and if your platform is not there, we will be happy to support it for you.

Easy to to deploy on premises or dedicated cloud
In the SaaS industry, the requirement for a dedicated single-tenant instance or an on-premises installation may be driven by specific business needs, such as tight security, data sovereignty, and geo-location considerations. Meterian can easily provide a single-tenant environment, either on-cloud or on-prem, and offers also a range of air-gapped solutions for extreme secure environments.

Comprehensive vulnerability database
Meterian’s vulnerability database not only boasts a broader coverage than any of its competitors but is also updated daily through a fully automated system that integrates numerous OSINT sources and Meterian’s specially curated databases, including AI-generated advisories directly from the analysis of open-source repositories. This automated process outpaces manual entry methods, ensuring we maintain a competitive edge through faster and more efficient updates, a key differentiation in our service offering.

Superior customer support
Speed, quality of responses, customer obsession, won deals because of this. We have a unique culture where the concept of “support” does not really exist, as all engineers are constantly working with customers. We want to be obsessed with customers, solve their problems quickly and effectively. Every customer support query is directly handled by engineers and is given priority in our backlog. This approach guarantees that our product evolves in response to real-world feedback, while also maintaining the highest level of customer satisfaction.

What next?

Don’t just take our word for it – experience the benefits for yourself. We invite you to schedule a demo to see how our solution can make a difference in your organisation’s security posture. Our team of experts is ready to guide you through the features and show you how it can address your specific security challenges. Take the first step towards a more secure future – reach out today and discover how Meterian can elevate your cybersecurity strategy.

Looking forward hearing from you.

Meeting Compliance Challenges in Healthcare: How Cybersecurity Partnerships Can Lead to Success

July 11, 2024July 11, 2024 bbossolabusiness, compliance, cybersecurity, healththech, SBOM, security, technologyLeave a comment

As healthcare companies face a complex web of EU and US regulations, understanding and adhering to these standards is crucial for maintaining trust and operational continuity. Regulations such as the EU’s Medical Device Regulation (MDR), the Network Information Security (NIS) directive, and upcoming legislation like the Cyber Resilience Act (CRA) and Digital Operational Resilience Act (DORA) demand meticulous compliance and robust cybersecurity measures.

Specifically, MDR requires stringent oversight of software used within medical devices, demanding thorough documentation and regular updates to ensure safety and performance. Meterian simplifies these tasks by automating the detection of vulnerabilities and outdated components in software, facilitating compliance through comprehensive Software Bill of Materials (SBOMs). These SBOMs provide a detailed inventory of all software components, crucial for MDR compliance, and help healthcare organisations maintain the integrity and security of their medical devices. By streamlining these processes, Meterian not only aids in meeting regulatory requirements but also enhances operational efficiency and reduces the risk of non-compliance penalties.

Meterian stands as a pivotal ally for healthcare companies navigating these regulatory landscapes. By offering tools that facilitate compliance with these stringent regulations, Meterian ensures that healthcare providers can focus more on patient care and less on the nuances of cybersecurity compliance.

The conversation around SBOMs and compliance is growing, and Meterian is leading these discussions with healthcare companies, showcasing how automation and detailed compliance reporting can ease the burden on healthcare providers. Whether it’s a startup or a seasoned enterprise, Meterian’s scalable solutions fit diverse budgets and operational scales, making comprehensive cybersecurity accessible to all healthcare entities.

By partnering with Meterian, healthcare companies not only ensure compliance with current regulations but also prepare for future legislative changes. Meterian’s proactive approach helps companies anticipate and adapt to the regulatory landscape, ensuring that they are always one step ahead in their cybersecurity measures.

Are you ready to elevate your healthcare organisation’s compliance and cybersecurity strategy?

Partner with Meterian today to ensure that your technology infrastructure meets the stringent demands of regulations like the NIS Directive and MDR. Don’t wait until a cybersecurity incident occurs – take proactive steps to safeguard your patient data and systems.

Visit our website or contact us to learn how Meterian can help your healthcare organisation stay secure, compliant, and resilient in an ever-evolving digital landscape.

Big News for Flutter Fans: Meterian Now Supports Dart!

June 21, 2024June 20, 2024 bbossolacybersecurity, dart, futter, meterian, opensource, riskLeave a comment

Great news for all you mobile developers out there! Meterian, a leading Software Composition Analysis (SCA) platform, has just rolled out support for Dart, the programming language that’s become super popular for building Flutter apps. If you’re crafting mobile apps with Flutter, this update is specially tailored for you. Let’s dive into what this means and why it’s a game changer for Flutter developers.

Why Dart and Flutter are a big Deal

Developed by Google, Dart is all about building smooth and stunning mobile and web applications, and it’s the powerhouse behind Flutter—Google’s UI toolkit for crafting beautiful, natively compiled applications from a single codebase. Flutter’s ability to deliver apps that feel great on both Android and iOS has made it a hot favorite. With Dart now getting the spotlight it deserves, security and efficiency in app development are set to reach new heights.

Meterian embraces Dart

With Dart on its radar, Meterian is making sure that your development toolkit is not just powerful but also secure. This inclusion means Meterian can now safeguard your Flutter projects right from the get-go, catching potential security slip-ups before they become real headaches.

Meterian’s leap to include Dart is more than just an update—it’s setting a new standard for mobile app security. By embracing the needs of the Flutter community, Meterian is not only beefing up the security of apps but is also paving the way for projects that scale smoothly and stay robust under pressure.

What’s in it for Flutter developers?

We believe Flutter will eventually get a dominant position in the mobile development scene, so it’s essential to have tools that ensure that your applications are rock-solid safe. Meterian’s support for Dart brings you a suite of benefits:

Boosted Security: Spot vulnerabilities early in the development cycle with Meterian’s SCA tools, keeping your apps safe from security threats.
Stay on the Right Side of Compliance: Keep up with the latest security standards easily, ensuring your app complies with legal and regulatory requirements.
Seamless Development Flow: Meterian fits right into your existing workflows, helping you patch up security issues without slowing you down.
Scale with Confidence: As your app grows, Meterian grows with it, making sure that even the most complex projects stay manageable and secure.

I want to use Meterian: what should I do?

Meterian is free for open source projects! If you have a GitHub OSS project, you can easily integrate Meterian using the GitHub Action following this step-by-step guide or you can checkout this live example on GitHub. We do have also native integrations with BitBucket and Azure Devops, and also integrations with other CI/CD platforms.

Meterian is here to help!

With Dart in Meterian’s toolkit, it’s an exciting time to be building apps with Flutter. This move shows Meterian’s commitment to supporting the latest and greatest in app development, making it easier for you to build apps that aren’t just awesome but are also secure and compliant. To learn more about Meterian’s support for Dart/Flutter and how it can help improve the security of your projects, visit Meterian’s website at www.meterian.io.

Ensuring Data Integrity and Security in Healthcare: The Crucial Role of Application Security

June 11, 2024 bbossolacompliance, cyber-security, cybersecurity, CyberUK24, information-security, opensource, risk, SBOM, security, technologyLeave a comment

In the digital age, healthcare companies are guardians of vast amounts of sensitive user data, ranging from personal health records to financial information. With this responsibility comes the challenge of ensuring data integrity and security against the growing threats of cyberattacks and data breaches. Meterian, a leader in application security, is at the forefront of providing solutions that safeguard this critical data.

Healthcare providers harnessing open-source software face unique security risks that require vigilant management and protection strategies. Meterian’s innovative tools actively scan and identify vulnerabilities within applications, ensuring that all components are up to date and secure against potential threats. By leveraging Meterian’s capabilities, healthcare companies can not only protect their patient data but also enhance their overall cybersecurity posture.

Protecting patient records.

In collaboration with Emis Group, a well-established brand in healthcare technology, Meterian has demonstrated its value in real-world applications. Emis has utilised Meterian’s solutions to bolster their applications’ defences, thereby protecting millions of patient records. While our partnership with Emis illustrates Meterian’s capability to handle the complex cybersecurity needs of large enterprises, it’s important to recognise that our solutions are equally effective and accessible for SMEs and startups. Meterian understands the unique challenges faced by smaller organisations, including tighter budgets and limited resources, as our platform is designed to be flexible and scalable.

For healthcare organisations, the fear of missing out on the highest level of security should be a significant concern. Meterian provides an essential layer of security that automates and streamlines the detection and management of vulnerabilities—tasks that would otherwise consume valuable development resources. As legislation evolves and compliance becomes even more stringent, Meterian’s tools help healthcare companies stay ahead, ensuring they meet all regulatory requirements while securing user data against emerging threats.

A successful case study.

To see first – hand how Meterian is enhancing cybersecurity in the healthcare industry, we invite you to explore our success story with Emis Group. This case study provides a detailed look at how Emis leveraged Meterian’s cutting-edge solutions to fortify their application security, ensuring compliance with stringent regulations and protecting sensitive patient data.

Visit Meterian today!

Discover Meterian at CyberUK 2024

April 29, 2024April 30, 2024 bbossolacompliance, cyber-security, cybersecurity, CyberUK24, information-security, opensource, risk, SBOM, security, technologyLeave a comment

The UK government’s flagship cyber security event, CyberUK 2024. is just around the corner! Hosted by the National Cyber Security Centre (NCSC), this annual gathering brings together over 2,000 cyber security leaders and professionals for networking, knowledge exchange, and collaboration.

Deputy Prime Minister Oliver Dowden recently announced the theme for CYBERUK 2024 during a speech at techUK. The focus will be on how the cyber community can harness the societal benefits of emerging technologies while ensuring their security for the future. This theme is particularly relevant as we navigate the ever-evolving landscape of cyber threats and opportunities.

What to Expect

Networking and Learning: Over 2,000 cyber security experts will convene in Birmingham from May 13th to 15th. Attendees will have the opportunity to network, learn from world-leading experts, and collaborate on pressing challenges facing the global cyber community.
Expert Speakers: More than 100 expert speakers will share insights on the threat landscape, resilience, and cutting-edge developments. From employing AI in healthcare research to using quantum computers for climate change solutions, CYBERUK 2024 promises to explore exciting possibilities
Exhibitors and Sponsors: Meet 150+ sponsors and exhibitors, fostering collaboration, learning, and innovation. These partnerships are crucial for addressing cyber challenges across public and private sectors

Where to find us

We will be exhibiting at CyberUK 2024. Loved by SMEs and CNI, our secure-by-design agile approach to software development delights developers and compliance teams. Come and learn how Meterian protects the Open Source Software Supply Chain.

Visit us Stand IZ3 at the Birmingham ICC, May 13-15th.

Understanding the Importance of Software Composition Analysis in the Context of EU’s DORA Regulations

April 15, 2024April 16, 2024 bbossolacompliance, cybersecurity, meterian, vulnerabilitiesLeave a comment

The EU’s Digital Operational Resilience Act (DORA) represents a significant step towards ensuring that the financial sector can withstand and rapidly recover from ICT-related disruptions and threats. Among the wide variety of security testing tools and actions mandated by DORA, Software Composition Analysis (SCA) emerges as a critical component. Let’s explore why SCA is vital in this new regulatory landscape and how solutions like Meterian can be particularly beneficial.

What is Software Composition Analysis?

Software Composition Analysis (SCA) is a cybersecurity process that helps organizations identify and manage open source components within their software inventory. SCA tools scan software projects to detect open source libraries and frameworks, check the versions used, and compare them against databases of known vulnerabilities. Additionally, SCA assesses license compliance risks, ensuring that the open source licenses are compatible with corporate policies on software usage.

The Role of SCA Under DORA

The DORA framework emphasizes the need for a broad and adaptable approach to cybersecurity, recognizing the diverse nature of financial entities and their varying levels of ICT maturity. Here’s why SCA is integral to this approach.

Vulnerability Management
Financial entities utilize a plethora of software solutions, many of which rely on open-source components. SCA provides a systematic approach to detecting vulnerabilities in these components, some of which may be critical and widely exploited in the financial sector. By identifying these vulnerabilities early, financial institutions can patch them before they are exploited.

Compliance and Risk Management
DORA calls for rigorous compliance standards, including in areas like software licensing. SCA tools automatically detect the licenses of every component and alert teams about potential legal and operational risks, thus supporting compliance with DORA requirements.

Enhanced Operational Resilience
By integrating SCA into their cybersecurity practices, financial institutions can improve their operational resilience. Knowing exactly what is in their software reduces the time and resources spent on crisis management in the event of a security breach.

Supporting Advanced Testing Requirements
As entities mature, advanced testing such as Threat-Led Penetration Testing (TLPT) becomes viable. SCA ensures that the foundational elements of software security are addressed, which is critical for conducting more sophisticated, scenario-based tests effectively.

How Meterian Can Help

In the context of DORA, Meterian stands out as a valuable ally for financial institutions aiming to enhance their software security posture. Here’s how Meterian can specifically support compliance and resilience:

Continuous Security and Compliance Monitoring: Meterian continuously scans your software projects, providing real-time alerts on new vulnerabilities and compliance issues. This ongoing monitoring ensures that financial entities can respond promptly to emerging threats.
Automated Fix Suggestions: Beyond identifying issues, Meterian provides actionable insights and automated fix suggestions. This helps in quickly resolving vulnerabilities and license conflicts, significantly reducing the window of exposure.
Ease of Integration: Meterian’s platform can be seamlessly integrated into existing development workflows. This integration ensures that security and compliance checks occur throughout the software development life cycle, aligning with DORA’s emphasis on continuous improvement and adaptation.
Customizable Reporting: Meterian offers detailed, customizable reports that can assist financial entities in demonstrating their compliance with DORA regulations to regulators. These reports provide clear evidence of the proactive measures taken to ensure operational resilience.

By leveraging SCA tools like Meterian, financial institutions can not only meet the stringent requirements set forth by DORA but also significantly strengthen their cybersecurity frameworks. This proactive approach to software security is essential in a landscape where digital operations are increasingly integral to financial stability and success.

NVD Update Delays: What’s Happening at the National Vulnerability Database?

April 8, 2024 bbossolacyber-security, cybersecurity, NVD, opensource, security, vulnerabilityLeave a comment

Introduction

Since its inception in 2005, the National Vulnerability Database (NVD) has been a vital resource for security professionals, providing details about common vulnerabilities and exposures (CVEs) discovered by researchers worldwide. However, in recent months, the NVD has faced significant challenges, resulting in delays and incomplete data. In this blog post, we explore the current state of the NVD and its implications for enterprise security.

The Mysterious Freeze

In February, the NVD underwent an unexpected transformation. A cryptic announcement appeared on its website, stating that users would “temporarily see delays in [our] analysis efforts” while the National Institute of Standards and Technology (NIST) implemented improved tools and methods. Unfortunately, no further explanation accompanied this message. The freeze affected the timely documentation of CVEs, leaving security managers in a bind.

The CVE Model and Missing Details

The NVD relies on a network of 365 partners—both US-based and international—who contribute threat data. These partners include software vendors, bug bounty operators, and private research firms. Each participant adheres to a schema to ensure unique and accurate entries. However, since the beginning of the year, over 6,000 new CVEs have been posted, with nearly half lacking essential details in the NVD.

What’s Missing?

Metadata: The latest CVE entries lack critical metadata, such as information about affected software. Without this context, security managers struggle to assess the severity of vulnerabilities and prioritize patching efforts.
CVSS Scores: The Common Vulnerability Scoring System (CVSS) scores, which indicate vulnerability severity, are absent for many CVEs.
Product Information: Enterprises rely on NVD data to identify which applications and operating systems are at risk. Unfortunately, the missing details hinder this crucial aspect.

The status of things (April 2024)

In this recent update from the NVD team they discuss the importance of the National Vulnerability Database (NVD) and the challenges it faces. The NVD is a repository of information on software and hardware flaws that can compromise computer security. There is a growing backlog of vulnerabilities submitted to the NVD, and NIST is working to address this challenge. NIST is committed to its continued support and management of the NVD, but at this time it seems to be lagging behind.

How Meterian can help

Enter Meterian, a comprehensive application security solution that offers unique advantages over traditional databases. Meterian has an extremely robust security database that implements:

Automated Daily Updates: Unlike the NVD, which has experienced recent delays, Meterian’s security database is updated at least every 4 hours. This automated process ensures that you receive the most current threat intelligence promptly.
Diverse Data Sources: Meterian aggregates data from more than 15 unique sources, including both public and private feeds. These sources contribute to a comprehensive repository of vulnerability information, covering a wide range of software components. This is also enriched by Meterian AI and internally curated databases.
Monitoring 350K Vulnerabilities: At present, Meterian actively monitors around 350,000 vulnerabilities across various ecosystems, from Perl to Rust. If you’re building applications and dealing with open-source libraries or frameworks, Meterian has you covered.

Conclusion

As the NVD grapples with its challenges, consider integrating Meterian into your security toolkit. Stay informed, stay proactive, and safeguard your digital assets effectively. Alternatively, you can simply start receiving timely notification through our alerting system: please check out our previous article that explains how to do just that!

References: