Milestone: Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale: Sonatype Research Labs logged 149,329 open source malware ...

Real-time intelligence, governance at selection, and agentic remediation help enterprises fix the risk that outpaces the speed of AI-driven assembly. Sonatype Research Labs also unveiled The AI-Era ...

A malicious release of TensorLake's TypeScript SDK, tensorlake@0.5.144, used an install hook to search for developer credentials and accept remote commands. Sonatype's code review found that its ...

AI is changing the tempo of software development. Code that once took hours to write now appears in seconds. AI agents draft pull requests, generate tests, refactor code, and recommend dependencies, ...

The first defense for trustworthy software is deciding what enters the build. For years, a repository's job was to give developers a reliable place to find the packages and artifacts their projects ...

Report security issues for a potential reward. Rewards are based on the severity of the finding and its impact on the organization. Let’s work together to help secure Sonatype’s products and services ...

Give your existing artifact repositories a proactive layer of malware protection. Sonatype Firewall Pro screens package requests at the registry proxy, blocking known malicious open source components ...

AI agents are choosing code and dependencies faster than teams can review them. In this video, Sonatype CTO and co-founder Brian Fox explains why the repository is a critical place to make those ...

Today’s enterprise repository is asked to manage a different software supply than it was built for a decade ago. Modern development increasingly draws from newer language ecosystems, rapidly expanding ...

AI-assisted development is making it easier to create code, assemble applications, and introduce new software into the development workflow. For application development and platform leaders, a ...

As open source software continues to fortify modern applications, attackers are finding new and increasingly efficient ways to exploit the trust developers place in public ecosystems. Sonatype ...