Malicious PyPI Package Removes netstat, Tampers with SSH Config

A recent report by Sonatype security researcher Ax Sharma highlights newly discovered malicious packages on the PyPI registry, including aptx, which can install the Meterpreter trojan disguised as pip, delete the netstat system utility, and tamper with SSH authorized_keys file.

Sonatype BOM Doctor Evaluates and Helps Patch Java Software Bills of Materials

BOM Doctor is a free, GitHub-hosted tool created by Sonatype to scan software bills of materials (SBOMs) and identify vulnerabilities and legal issues.

GitHub Enhances CodeQL, Extends Language Support, Available Queries, and More

After adding support for Ruby at GitHub Universe 2022, CodeQL introduced Kotlin support in beta. Additionally, support for other languages has been extended to include more recent versions. GitHub has also extended available queries to fully cover several industry-wide vulnerability directories, and improved the CodeQL ecosystem.

Ably Terraform Provider Aims to Power Realtime Architectures Using Infrastructure as Code

Developed by Ably in partnership with HashiCorp, the Ably Terraform Provider enables using Terraform, a popular open-source infrastructure as code (IaC) tool, to provision and manage Ably solutions programmatically.

Traffic Protocol Analyzer Wireshark Gets its Own Foundation

The popular open-source protocol analyzer Wireshark has a new permanent home in the form of the Wireshark Foundation, which should provide the means for its further, long-term evolution, says Sysdig, which took over as the project main sponsor in 2022.