ReversingLabs

When appraising the legitimacy of packages in software repositories, developers and even security tools often rely on download counts. Nonetheless, the metric can be weaponized by threat actors who use automated systems such as repository mirrors and analysis bots to poison software packages and infect supply chains.Researchers at Tenable discovered the new technique, which they’re calling “download pumping,” while analyzing npm packages uploaded to the public registry, senior security researche

Last week, RL discovered an active Microsoft 365 device code phishing campaign that abuses Microsoft’s legitimate OAuth 2.0 Device Authorization Grant flow to obtain access to victim accounts.Rather than stealing passwords through a counterfeit login page, the phishing kit persuades victims to complete a legitimate Microsoft authentication process that authorizes an attacker-controlled device.In this companion Spectra Analyze in Action post, you’ll find a deep dive on how it works, including the

Organizations investing in software bill of materials (SBOM) practices are starting to see the payoff as it becomes easier and less of a time sink to chase down what’s actually running in production when supply chain incidents make headlines. The only problem is that with AI, the software supply chain visibility goalposts are moving.AI supply chain attacks are in their infancy, but this spring has given us a preview of what life with AI-embedded software is going to look like. In March, two PyPI

Organizations looking for a faster and more structured way to threat model their AI systems now have access to an open-source resource designed to help identify security risks before they become exploitable vulnerabilities.The OWASP Foundation’sThreat Advisoris an AI-powered assistant that guides users through the threat modeling process by first asking them to describe their AI system and then conducting an interactive interview to identify relevant threats, assess risk, and recommend mitigatio

In early 2026, sources began reporting an uptick in SVG based malware. SVG, standing for scalable vector graphics, is a filetype usually utilized to create vector images. SVGs are special due to their ability to utilize Javascript.Threat actors use this functionality to craft SVG files that can act maliciously. Malicious SVGs can take the form of fake login pages, data exfiltrators, or malicious downloaders, amongst other things. SVGs are frequently overlooked, as they are assumed to be benign i

Open-source software underpins some of the world’s most critical infrastructure. Banking, telecommunications, and utilities all run on software that shares the same OSS libraries. Finding vulnerabilities in that software is pressingly important, but it can take experts weeks to do so. Now, artificial intelligence can find them in minutes.As good as that might sound, the speed of discovery does bring problems. With that in mind, the Linux Foundation and industry heavyweights including Amazon Web

A new report finds weakening trust in AI-only testing — and more willingness to keep humans in the loop.A year ago, nearly three of every 10 organizations were comfortable letting AI run their penetration testing end to end — no humans required. Today, confidence in that model has collapsed.Cobalt’s newAI and Pentesting Pulse Report 2026— based on a survey of 455 cybersecurity professionals — found the share of organizations relying solely on AI automation for testing fell from 29% in 2025 to ju

Remember those words of advice for the over-eager fromWest Side Story? “Boy, boy, crazy boy, be cool boy.” They should be heeded by developers hell-bent on installing the latest updates to open-source software. Adopting a “cooldown” policy on updates can be a simple but effective way to avoid downloading malicious code.Noelle Murata, a senior security engineer at Xcape, said organizations should enforce a three-to-four-day minimum age requirement for new packages and updates.“A short delay gives