A malicious release of TensorLake's TypeScript SDK, tensorlake@0.5.144, used an install hook to search for developer credentials and accept remote commands. Sonatype's code review found that its ...

Milestone: Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale: Sonatype Research Labs logged 149,329 open source malware ...

Secure open source consumption requires more than an approved package registry or a scan before release. Teams need to control where components come from, evaluate ...

Sonatype is proud to be recognized as a Leader in The Forrester Wave™: SCA Software 2024. Forrester evaluated 10 top providers and named Sonatype a Leader among them. To us, this underscores our ...

Report security issues for a potential reward. Rewards are based on the severity of the finding and its impact on the organization. Let’s work together to help secure Sonatype’s products and services ...

With over 100,000 deployments globally, Nexus Repository received the highest rating among leaders. See why enterprises choose Sonatype Nexus Repository.

This Acceptable Use Policy (this “Policy”)applies to your use of all Services offered by Sonatype. The examples described in this Policy are not exhaustive. We may modify this Policy at any time by ...

“As society becomes more dependent on digital products, customers expect us to do better. Regulation helps enforce the standards society now depends on.” Open source software has become the central ...

As open source software continues to fortify modern applications, attackers are finding new and increasingly efficient ways to exploit the trust developers place in public ecosystems. Sonatype ...

Sonatype identified 21,764 open source malware packages in Q1 2026, bringing the total logged since 2017 to 1,346,867. npm accounted for 75% of malicious packages this quarter. Trojans dominated, with ...

Attackers compromised part of the Mastra AI framework and added easy-day-js as a dependency across a large number of Mastra packages. Once installed, the package used a postinstall script to attempt ...

Today, news broke that a security researcher managed to breach systems of over 35 tech companies in what has been described as a novel software supply chain attack. By taking advantage of a concept ...