Brian Fox

Sustaining Package Repositories with Brian Fox Brian Fox discusses the challenges and future of open source package repository infrastructure. We discuss the complexities of managing public registries, the impact of overconsumption, and the import...

On #OpenSourceSecurity I had a chat with @brianfox.bsky.social about the sustainability letter from the open source package registries

This one is a big deal. The costs for open source are paid by someone, if you don't know who, you need to read this letter

opensourcesecurity.io/2025/2025-10...

Yes all of this. Now it’s time to fix it.

From Abuse to Alignment: Why We Need Sustainable Open Source Infrastructure Open source relies on shared infrastructure. Learn why sustainable stewardship is critical to keep ecosystems like Maven Central strong.

Free isn’t free: the infrastructure behind open source has real costs, and it’s time we aligned usage with responsibility.

This morning we jointly launch a new blog and open letter on sustainable stewardship.

www.sonatype.com/blog/from-ab...

We see more new affected packages over night. It highlights why we built this ml/model for this back when it was still called ml/ai and use it to protect customers in real time.

We will be updating the blog shortly with the new packages.

npm Chalk and Debug Packages Hit in Software Supply Chain Attack Learn about the npm chalk and debug widespread software supply chain attack, highlighting risks and the need for better SBOM and SCA practices.

Looks
Like we got them taken down. So here it is: www.sonatype.com/blog/npm-cha...

More than 1

Our malware systems at Sonatype seem to be picking these up coming from other, not yet reported accounts. This attack seems to have landed more publishers as this unfolds. Check your accounts folks while we work with others to contain.

Fair. Maybe it’s a scam. Will have to wait and see.

Open-source malware doubles, data exfiltration attacks dominate - Help Net Security A total of 17,954 open source malware packages identified in Q1 2025, according to Sonatype's Open Source Malware Index.

Open-source malware doubles, data exfiltration attacks dominate

📖 Read more: www.helpnetsecurity.com/2025/04/03/o...

#cybersecurity #cybersecuritynews #opensource @brianfox.bsky.social

CVE Foundation FOR IMMEDIATE RELEASE April 16, 2025 CVE Foundation Launched to Secure the Future of the CVE Program [Bremerton, Washington] – The CVE Foundation has been formally established to ensure the long-term ...

www.thecvefoundation.org

Good news for Java developers! Central now validates OpenSSF sigstore signatures as part of publishing. If you’re already signing your artifacts with Sigstore, you’ll now get real-time validation feedback in the Central Publisher Portal.

Read more details here: www.sonatype.com/blog/central...

📢 The @linuxfoundation.org, with Harvard's Laboratory for Innovation Science, has released Census III of Free and Open Source Software – Application Libraries. 🖥️ Key insights from OpenSSF help reduce FOSS vulnerabilities and secure supply chains. Read more: openssf.org/press-releas...