Open-source adoption is being accelerated by AI and automation, but developers need to proceed with caution to ensure they’re not introducing extra risk into their software supply chain. Brian Fox, co-founder and CTO of Sonatype, explained that AI can accelerate good engineering, but it can also scale mistakes faster, especially if it doesn’t have real-world … continue reading
Doctors have to follow the Hippocratic Oath, swearing to do no harm to their patients. Developers ought to be following a similar oath, promising to do no harm to their codebase when implementing new features or making changes. Mitchell Johnson, chief product development officer at Sonatype, explored this concept and if it’s even still possible … continue reading
Sonatype finds 188% increase in open source malware since last year The company published its Open Source Malware Index for Q2 2025, finding 16,279 new malicious open source packages. Compared to the same quarter last year, there was a 188% increase in the number of malicious packages discovered. 4,400 of the packages were designed to … continue reading
Despite having just celebrated its 30 year anniversary, Java is still going strong. Scroll through the list of other programming languages created in the 90s and you won’t find many names you’d still recognize today, yet Java is still prevalent across the industry. TIOBE’s Programming Community index for June 2025 ranks Java as the fourth … continue reading
Sonatype, a company focused on software supply chain security, has announced the results of its quarterly Open Source Malware Index, which provides insights into malicious open source packages. The index found 17,954 malicious open source software packages, including several hijacked npm crypto packages, a malicious npm package disguised as the Truffle for VS Code extension, … continue reading
In 2023, there was an 18% decline in the number of open-source projects that are considered to be “actively maintained.” This is according to Sonatype’s Annual State of the Software Supply Chain Report. The report claims that only 11% of open-source projects are actually actively maintained. Despite these flaws, Sonatype still says that 96% of … continue reading
Fulton, Md., Aug. 21, 2023 (GLOBE NEWSWIRE) — Sonatype, the pioneer of software supply chain management, has announced new product capabilities for Sonatype Repository Firewall, Sonatype Nexus Repository and Sonatype Lifecycle. Bolstering Sonatype’s industry-leading software supply chain management platform, these enhancements are designed to give organizations greater control of their software development life cycle (SDLC) while meeting the evolving needs … continue reading
The software supply chain security company Sonatype is attempting to make it easier for development and security teams to come together and innovate. They announced new deployment options, enabling companies to run Sonatype software in the cloud. Nexus Lifecycle and Nexus Firewall can now be deployed in the cloud, which enables companies to get up … continue reading
In recent years, hackers have become very sophisticated in the ways they attack upstream development pipelines by introducing vulnerabilities into the software supply chain. The popularity of open source makes those repositories a low-hanging fruit to target. In an SD Times Live! Event titled “Threat Landscapes: An Upstream and Downstream Moving Target,” Theresa Mammarella, developer … continue reading
Sonatype found that nearly 70% of dependency management decisions are suboptimal in a study that evaluated 100,000 production applications and 4,000,000 open-source component migrations. A large part of this is due to lack of security automation, explained Ax Sharma, senior security researcher, and advocate at Sonatype, in a webinar called “The Impact of Zero-Day Attacks … continue reading
Organizations have been forced to learn the hard way over the past year the importance of software supply chain security. In late 2021, a vulnerability was detected in Log4j, which is a framework for logging in Java that is used as a dependency in over 7,000 open-source projects. This was just one example of a … continue reading
For a long time, security teams have been able to mostly rely on the safety of a security perimeter, but with things like IoT, embedded development, and now remote and hybrid work, this notion of a defensible perimeter is totally gone. Having all of these connected devices that don’t live under one network expands the … continue reading
