home.social

#developersecurity — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #developersecurity, aggregated by home.social.

  1. ----------------

    🛠️ Tool
    ===================

    Bumblebee is a read-only inventory collector targeting package, extension, and developer-tool metadata on macOS and Linux developer endpoints. It addresses a specific supply-chain response gap: when an advisory names a package or version, which developer machines currently have a matching entry in their on-disk metadata?

    The problem space

    SBOMs tell you what shipped. EDR tells you what ran or touched the network. But supply-chain incidents often require a third view: the messy local state spread across lockfiles, package-manager install metadata, extension manifests, and developer-tool configuration files. Bumblebee turns that scattered on-disk state into structured NDJSON component records and, when given an exposure catalog, flags exact matches for fast triage.

    Technical architecture
    • Single static binary, Go 1.25+, zero non-stdlib dependencies. Straightforward fleet deployment.
    • Three scan profiles (baseline, project, deep) for different populations and cadences.
    • Strictly read-only: no package manager execution (npm ls, pip show, go list), no source-file reads.
    • MCP host configs can carry environment values and credentials in env blocks. Bumblebee parses these for server inventory but does not emit those values in output records.

    Ecosystem coverage
    • npm, pnpm, Yarn, Bun (via lockfiles and node_modules)
    • PyPI (via dist-info/METADATA, egg-info)
    • Go modules (go.sum, go.mod)
    • RubyGems (Gemfile.lock, *.gemspec)
    • Composer (composer.lock, installed.json)
    • MCP JSON host configs (Claude Desktop, Cline, Gemini CLI/Code Assist). Non-JSON configs like Codex config.toml and Continue YAML not parsed in v0.1.
    • Editor extensions: VS Code, Cursor, Windsurf, VSCodium
    • Browser extensions: Chromium-family, Firefox

    Self-test

    bumblebee selftest runs against embedded fixtures with deliberately fake package names ([email protected]). Useful as a pre-deployment smoke test for fleet rollouts.

    go install github.com/perplexityai/bumblebee/cmd/bumblebee@latest
    bumblebee selftest

    Known limitations
    • Read-only by design: no runtime dependency or process detection
    • bun.lockb presence detected but not parsed (diagnostic only)
    • Non-JSON MCP configs unsupported in v0.1
    • Note: haven't tested personally

    🔹 tool #supplychain #SBOM #inventory #developersecurity

    🔗 Source: github.com/perplexityai/bumble

  2. Anil Bhasin from Wiz told TechNadu, “Rather than asking developers to decode generic alerts, the focus should be on delivering clear, contextual findings.”
    He explains how developer-first security empowers innovation through automation, collaboration, and shared ownership. technadu.com/the-security-dile

    #CyberSecurity #DevSecOps #AppSec #Wiz #DeveloperSecurity #TechNadu

  3. Anil Bhasin from Wiz told TechNadu, “Rather than asking developers to decode generic alerts, the focus should be on delivering clear, contextual findings.”
    He explains how developer-first security empowers innovation through automation, collaboration, and shared ownership. technadu.com/the-security-dile

    #CyberSecurity #DevSecOps #AppSec #Wiz #DeveloperSecurity #TechNadu

  4. Anil Bhasin from Wiz told TechNadu, “Rather than asking developers to decode generic alerts, the focus should be on delivering clear, contextual findings.”
    He explains how developer-first security empowers innovation through automation, collaboration, and shared ownership. technadu.com/the-security-dile

    #CyberSecurity #DevSecOps #AppSec #Wiz #DeveloperSecurity #TechNadu

  5. The DevOps space is under siege.
    GlassWorm, a self-propagating worm in VS Code extensions, uses Solana blockchain for C2, invisible Unicode for stealth, and targets developer credentials, crypto wallets, and Git repositories. Auto-updating extensions make the threat persistent.
    💬 InfoSec pros: how should organizations defend against this evolving supply chain risk?
    🔁 Share & follow TechNadu for expert analysis on emerging malware and blockchain-enabled attacks.

    #GlassWorm #VSCode #SupplyChainAttack #DevSecOps #BlockchainSecurity #Malware #InfoSec #DeveloperSecurity #CyberThreats #TechNews

  6. The DevOps space is under siege.
    GlassWorm, a self-propagating worm in VS Code extensions, uses Solana blockchain for C2, invisible Unicode for stealth, and targets developer credentials, crypto wallets, and Git repositories. Auto-updating extensions make the threat persistent.
    💬 InfoSec pros: how should organizations defend against this evolving supply chain risk?
    🔁 Share & follow TechNadu for expert analysis on emerging malware and blockchain-enabled attacks.

    #GlassWorm #VSCode #SupplyChainAttack #DevSecOps #BlockchainSecurity #Malware #InfoSec #DeveloperSecurity #CyberThreats #TechNews

  7. The DevOps space is under siege.
    GlassWorm, a self-propagating worm in VS Code extensions, uses Solana blockchain for C2, invisible Unicode for stealth, and targets developer credentials, crypto wallets, and Git repositories. Auto-updating extensions make the threat persistent.
    💬 InfoSec pros: how should organizations defend against this evolving supply chain risk?
    🔁 Share & follow TechNadu for expert analysis on emerging malware and blockchain-enabled attacks.

    #GlassWorm #VSCode #SupplyChainAttack #DevSecOps #BlockchainSecurity #Malware #InfoSec #DeveloperSecurity #CyberThreats #TechNews

  8. The DevOps space is under siege.
    GlassWorm, a self-propagating worm in VS Code extensions, uses Solana blockchain for C2, invisible Unicode for stealth, and targets developer credentials, crypto wallets, and Git repositories. Auto-updating extensions make the threat persistent.
    💬 InfoSec pros: how should organizations defend against this evolving supply chain risk?
    🔁 Share & follow TechNadu for expert analysis on emerging malware and blockchain-enabled attacks.

    #GlassWorm #VSCode #SupplyChainAttack #DevSecOps #BlockchainSecurity #Malware #InfoSec #DeveloperSecurity #CyberThreats #TechNews

  9. The DevOps space is under siege.
    GlassWorm, a self-propagating worm in VS Code extensions, uses Solana blockchain for C2, invisible Unicode for stealth, and targets developer credentials, crypto wallets, and Git repositories. Auto-updating extensions make the threat persistent.
    💬 InfoSec pros: how should organizations defend against this evolving supply chain risk?
    🔁 Share & follow TechNadu for expert analysis on emerging malware and blockchain-enabled attacks.

    #GlassWorm #VSCode #SupplyChainAttack #DevSecOps #BlockchainSecurity #Malware #InfoSec #DeveloperSecurity #CyberThreats #TechNews

  10. WhiteCobra threat group targets developers with malicious VSCode extensions, stealing cryptocurrency from wallets. They've already stolen $500K+ and can generate fake credibility with 50K fake downloads in hours. Even experienced security professionals have fallen victim to these sophisticated attacks. #CyberSecurity #DevSecurity #VSCode #Malware #CryptoCurrency #DeveloperSecurity #WhiteCobra devops.com/whitecobra-targets-

  11. WhiteCobra threat group targets developers with malicious VSCode extensions, stealing cryptocurrency from wallets. They've already stolen $500K+ and can generate fake credibility with 50K fake downloads in hours. Even experienced security professionals have fallen victim to these sophisticated attacks. devops.com/whitecobra-targets-

  12. WhiteCobra threat group targets developers with malicious VSCode extensions, stealing cryptocurrency from wallets. They've already stolen $500K+ and can generate fake credibility with 50K fake downloads in hours. Even experienced security professionals have fallen victim to these sophisticated attacks. #CyberSecurity #DevSecurity #VSCode #Malware #CryptoCurrency #DeveloperSecurity #WhiteCobra devops.com/whitecobra-targets-

  13. WhiteCobra threat group targets developers with malicious VSCode extensions, stealing cryptocurrency from wallets. They've already stolen $500K+ and can generate fake credibility with 50K fake downloads in hours. Even experienced security professionals have fallen victim to these sophisticated attacks. #CyberSecurity #DevSecurity #VSCode #Malware #CryptoCurrency #DeveloperSecurity #WhiteCobra devops.com/whitecobra-targets-

  14. DNS attacks are not just legacy threats – they’re evolving.

    In my new article series, I explore modern DNS attack vectors like cache poisoning, tunneling, hijacking & spoofing – and how we as developers can defend at the protocol edge.

    A must-read if you're building Java-based backend systems or securing internal services.

    🔗 svenruppert.com/2025/04/07/dns

    #CyberSecurity #DNS #Java #Infosec #NetworkSecurity #SecureCoding #DNSAttack #DeveloperSecurity #PrivacyByDesign

  15. DNS attacks are not just legacy threats – they’re evolving.

    In my new article series, I explore modern DNS attack vectors like cache poisoning, tunneling, hijacking & spoofing – and how we as developers can defend at the protocol edge.

    A must-read if you're building Java-based backend systems or securing internal services.

    🔗 svenruppert.com/2025/04/07/dns

    #CyberSecurity #DNS #Java #Infosec #NetworkSecurity #SecureCoding #DNSAttack #DeveloperSecurity #PrivacyByDesign

  16. DNS attacks are not just legacy threats – they’re evolving.

    In my new article series, I explore modern DNS attack vectors like cache poisoning, tunneling, hijacking & spoofing – and how we as developers can defend at the protocol edge.

    A must-read if you're building Java-based backend systems or securing internal services.

    🔗 svenruppert.com/2025/04/07/dns

    #CyberSecurity #DNS #Java #Infosec #NetworkSecurity #SecureCoding #DNSAttack #DeveloperSecurity #PrivacyByDesign

  17. DNS attacks are not just legacy threats – they’re evolving.

    In my new article series, I explore modern DNS attack vectors like cache poisoning, tunneling, hijacking & spoofing – and how we as developers can defend at the protocol edge.

    A must-read if you're building Java-based backend systems or securing internal services.

    🔗 svenruppert.com/2025/04/07/dns

    #CyberSecurity #DNS #Java #Infosec #NetworkSecurity #SecureCoding #DNSAttack #DeveloperSecurity #PrivacyByDesign

  18. DNS attacks are not just legacy threats – they’re evolving.

    In my new article series, I explore modern DNS attack vectors like cache poisoning, tunneling, hijacking & spoofing – and how we as developers can defend at the protocol edge.

    A must-read if you're building Java-based backend systems or securing internal services.

    🔗 svenruppert.com/2025/04/07/dns

    #CyberSecurity #DNS #Java #Infosec #NetworkSecurity #SecureCoding #DNSAttack #DeveloperSecurity #PrivacyByDesign

  19. Ransomware in VSCode extensions raises serious concerns about Microsoft’s marketplace security.

    Two extensions—“ahban.shiba” and “ahban.cychelloworld”—were found on the Visual Studio Code Marketplace containing ransomware that evaded Microsoft’s security checks for months.

    Key takeaways:
    ・⚠️ Malicious code used PowerShell to fetch ransomware from a remote AWS server
    ・💸 Victims were told to pay 1 ShibaCoin—no actual payment instructions were provided
    ・🕒 Extensions stayed live despite being flagged by ExtensionTotal back in November 2024
    ・🧪 Ransomware appeared to be in an early testing phase, only encrypting files in test folders

    This incident highlights ongoing gaps in third-party extension vetting and the urgent need for tighter security controls—even on official marketplaces.

    Full story: cysecurity.news/2025/03/ransom

    #CyberSecurity #VSCode #Microsoft #Malware #DevTools #SecurityAwareness #Ransomware #Infosec #DeveloperSecurity

  20. Ransomware in VSCode extensions raises serious concerns about Microsoft’s marketplace security.

    Two extensions—“ahban.shiba” and “ahban.cychelloworld”—were found on the Visual Studio Code Marketplace containing ransomware that evaded Microsoft’s security checks for months.

    Key takeaways:
    ・⚠️ Malicious code used PowerShell to fetch ransomware from a remote AWS server
    ・💸 Victims were told to pay 1 ShibaCoin—no actual payment instructions were provided
    ・🕒 Extensions stayed live despite being flagged by ExtensionTotal back in November 2024
    ・🧪 Ransomware appeared to be in an early testing phase, only encrypting files in test folders

    This incident highlights ongoing gaps in third-party extension vetting and the urgent need for tighter security controls—even on official marketplaces.

    Full story: cysecurity.news/2025/03/ransom

    #CyberSecurity #VSCode #Microsoft #Malware #DevTools #SecurityAwareness #Ransomware #Infosec #DeveloperSecurity

  21. Ransomware in VSCode extensions raises serious concerns about Microsoft’s marketplace security.

    Two extensions—“ahban.shiba” and “ahban.cychelloworld”—were found on the Visual Studio Code Marketplace containing ransomware that evaded Microsoft’s security checks for months.

    Key takeaways:
    ・⚠️ Malicious code used PowerShell to fetch ransomware from a remote AWS server
    ・💸 Victims were told to pay 1 ShibaCoin—no actual payment instructions were provided
    ・🕒 Extensions stayed live despite being flagged by ExtensionTotal back in November 2024
    ・🧪 Ransomware appeared to be in an early testing phase, only encrypting files in test folders

    This incident highlights ongoing gaps in third-party extension vetting and the urgent need for tighter security controls—even on official marketplaces.

    Full story: cysecurity.news/2025/03/ransom

    #CyberSecurity #VSCode #Microsoft #Malware #DevTools #SecurityAwareness #Ransomware #Infosec #DeveloperSecurity

  22. GitHub detected 39 million exposed secrets in 2024! Learn how their major security upgrade protects your code with AI-powered scanning, free risk assessment, and enhanced push protection. Don't let your API keys become the next compromise.

    #SecurityLand #BusinessShield #CyberSecurity #GitHub #DeveloperSecurity

    Read More: security.land/github-bolsters-

  23. GitHub detected 39 million exposed secrets in 2024! Learn how their major security upgrade protects your code with AI-powered scanning, free risk assessment, and enhanced push protection. Don't let your API keys become the next compromise.

    #SecurityLand #BusinessShield #CyberSecurity #GitHub #DeveloperSecurity

    Read More: security.land/github-bolsters-

  24. My new blog post addresses my issues with the concept of "shift left security." It's not wrong, it's just misunderstood.

    Shifting left is about empowering developers to better secure their applications, freeing up security teams to scale to better support them. Security teams need to work with development throughout the SDLC to drive efficiency for remediation - helping both teams.

    techtarget.com/searchsecurity/

    #devsecops #cloudsecurity #infosec #developersecurity #cnapp #applicationsecurity #appsec

  25. My new blog post addresses my issues with the concept of "shift left security." It's not wrong, it's just misunderstood.

    Shifting left is about empowering developers to better secure their applications, freeing up security teams to scale to better support them. Security teams need to work with development throughout the SDLC to drive efficiency for remediation - helping both teams.

    techtarget.com/searchsecurity/

    #devsecops #cloudsecurity #infosec #developersecurity #cnapp #applicationsecurity #appsec

  26. My new blog post addresses my issues with the concept of "shift left security." It's not wrong, it's just misunderstood.

    Shifting left is about empowering developers to better secure their applications, freeing up security teams to scale to better support them. Security teams need to work with development throughout the SDLC to drive efficiency for remediation - helping both teams.

    techtarget.com/searchsecurity/

    #devsecops #cloudsecurity #infosec #developersecurity #cnapp #applicationsecurity #appsec

  27. My new blog post addresses my issues with the concept of "shift left security." It's not wrong, it's just misunderstood.

    Shifting left is about empowering developers to better secure their applications, freeing up security teams to scale to better support them. Security teams need to work with development throughout the SDLC to drive efficiency for remediation - helping both teams.

    techtarget.com/searchsecurity/

    #devsecops #cloudsecurity #infosec #developersecurity #cnapp #applicationsecurity #appsec

  28. My new blog post addresses my issues with the concept of "shift left security." It's not wrong, it's just misunderstood.

    Shifting left is about empowering developers to better secure their applications, freeing up security teams to scale to better support them. Security teams need to work with development throughout the SDLC to drive efficiency for remediation - helping both teams.

    techtarget.com/searchsecurity/

    #devsecops #cloudsecurity #infosec #developersecurity #cnapp #applicationsecurity #appsec