The Great NPM Heist: How the Attack Worked & How InvisiRisk Can Help Stop It
The Great NPM Heist: What Happened and How InvisiRisk Protects You In early September 2025 attackers orchestrated a large-scale supply chain compromise on the NPM registry. They phished several popular package maintainers to gain publishing rights, then pushed malicious updates to over 18 widely used JavaScript libraries (including chalk, debug, ansi-regex, strip-ansi, wrap-ansi, color-convert, etc.). […]
CVE-2025-48384: How Git’s Clone Command Becomes an Attack Vector
Git’s Silent Takeover: How a Simple Clone Command Can Compromise Your Entire System (CVE-2025-48384) In the world of software development, Git is the undisputed foundation of version control, a tool so integral and trusted that its security is often taken for granted. However, a recently discovered high-severity vulnerability, CVE-2025-48384, shatters this perception. This flaw, which […]
InvisiRisk Unveils Groundbreaking Build Security AI Agent
InvisiRisk Launches Revolutionary Build Security AI Agent for Software Supply Chain Protection InvisiRisk, Inc. is excited to announce the launch of its revolutionary Build Security AI Agent, designed to transform the security landscape of software supply chains. This innovative solution leverages advanced artificial intelligence to provide unparalleled protection for CI/CD pipelines, ensuring the integrity and […]
CI/CD Secrets Leaks: The Runtime Blind Spot in Build Security
Why Your Secrets Faucet Is Still Leaking: The Runtime Blind Spot in CI/CD Security We all know the nightmare scenario: sensitive credentials – API keys, database passwords, private certificates – leaked into the wild. Diligent teams implement a comprehensive strategy: secure storage with secret managers (like Vault or AWS Secrets Manager), static code scanning on […]
Don’t Let a Typo Sink Your Ship: Typosquatting Prevention Strategies
Don’t Let a Typo Sink Your Ship: Typosquatting Attacks and How InvisiRisk BAF Stops Them In today’s fast-paced software development world, efficiency is king. Developers often rely on vast ecosystems of open-source packages to build and enhance their applications. But within this convenience lies a hidden danger: typosquatting. This insidious attack method, where malicious actors […]
Could InvisiRisk Security Attestations Have Prevented the NHS Breach?
NHS IT Provider Hit with £3m ICO Fine: A Supply Chain Security Wake-Up Call The recent ICO fine levied against an NHS IT provider, Advanced Computer Software Group Ltd (ACSGL), serves as a stark reminder of the critical importance of robust supply chain security. The root cause? A ransomware attack exploiting security vulnerabilities, specifically the […]
CVE-2025-29927: Next.js Middleware Bypass & How to Prevent It
Next.js Middleware Vulnerability (CVE-2025-29927): How InvisiRisk BAF Provides Real-Time Protection Introduction In the ever-evolving landscape of web development, security remains a paramount concern. A recent discovery of a critical vulnerability in Next.js, identified as CVE-2025-29927, underscores the necessity for robust security measures within build processes. This blog post delves into the specifics of this vulnerability […]
How InvisiRisk BAF Mitigates GitHub Actions Supply Chain Attacks
How InvisiRisk BAF Effectively Mitigates GitHub Actions Supply Chain Attacks Like the Ultralytics Attack Introduction The rise of automation in software development has made CI/CD pipelines indispensable, with GitHub Actions standing out as a cornerstone for streamlining workflows. However, this reliance on automation introduces significant security risks, as demonstrated by the December 2024 supply chain […]
Ensuring Software Supply Chain Security with Blessed Repositories
Why Blessed Open-Source Repositories Matter In today’s rapidly evolving technological landscape, the importance of maintaining a secure and reliable software supply chain cannot be overstated. One critical aspect of this is the use of “blessed open-source repositories,” which serve as trusted sources for open-source components. These repositories are meticulously curated and approved by DevSecOps teams […]
Protect Software Supply Chains with Complete Security Coverage
Beyond Open Source Vulnerability Tracking: Comprehensive Software Supply Chain Security with InvisiRisk In today’s rapidly evolving digital landscape, securing the software supply chain has become more critical than ever. While tracking open-source software vulnerabilities is essential, it is just one piece of the puzzle. At InvisiRisk, we believe in a holistic approach to software supply […]