Top all-time · #1670
2024 Sonatype Blog
Company blog · blog.sonatype.comsecurityprogramming
2024 Sonatype Blog is the company blog at blog.sonatype.com, writing about security and programming. Since 2014, 44 different Hacker News readers have linked it 53 times, most often “Why Namespacing Matters in Public Open Source Repositories”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (24) to say how often HN recommends it.?
Why HN links it
Cited for write-ups on open-source supply chain attacks, malicious npm and PyPI packages, Maven namespacing and dependency reachability, plus Nexus product material. Mostly linked as background sources.
Summarised by Claude from a sample of 24 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Conversations about software supply automation, devsecops, open source, continuous delivery, and application security.
Most-linked posts?
- Why Namespacing Matters in Public Open Source Repositories4 people · 5 mentions · first linked 2021-02-11
- New PyPI Cryptomining Malware2 people · 2 mentions · first linked 2021-06-22
- /npm-project-used-by-millions-hijacked-in-supply-chain-attack2 people · 2 mentions · first linked 2022-03-18
- Log4shell by the Numbers2 people · 2 mentions · first linked 2021-12-14
- Apache Servers Actively Exploited in the Wild and the Importance of Patching2 people · 2 mentions · first linked 2021-10-05
- /eu-cyber-resilience-act-good-for-software-supply-chain-security-bad-for-open-source2 people · 2 mentions · first linked 2023-02-10
- Imposter Twilio NPM malware backdoors Linux machines2 people · 2 mentions · first linked 2020-11-02
- NPM packages caught exfiltrating Kubernetes config, SSH keys2 people · 2 mentions · first linked 2023-09-26
What Hacker News says?
Seems like the Maven registry is susceptible to artifact hijacking. Say I wan't to install artifacts from two GitHub users. I would have to add these two Maven repositories: - https://maven.pkg.github.com/USER1 - https://maven.pkg.github.com/USER2 In that case USER1 can publish an artifact with the same groupId/artifactId as USER2 and my Maven will happily install it without suspecting anything. Another case - someo…
Comment linking /hijacking-of-a-known-github-id-go-bindata
on “GitHub Package Registry”Submitted PyPI package 'secretslib' drops fileless Linux malware to mine Monero as a story · 170 points
HN discussionSonatype found a whole bunch of those and blogged about it in August. https://blog.sonatype.com/more-than-200-cryptominers-flood-n... Disclaimer: I currently work for Sonatype, but in a different area of the company.
Comment linking /more-than-200-cryptominers-flood-npm-and-pypi-registry
on “Dozens of malicious PyPI packages discovered targeting developers”Submitted PyPI: Python packets steal AWS keys from users as a story · 168 points
HN discussionOpen source projects are not a good point of reference because by their very nature they invite external validation. If you are trying to steal $300M, you don't tell people before hand that you are going to do it. There also a difference between the money being right there, only one step away from being yours and infecting open source software with the possibility of maybe stealing something in some company that may…
Comment linking /open-source-attacks-on-the-rise-top-8-malicious-packages-found-in-npm
on “In second largest DeFi hack, Blockchain Bridge loses $320M Ether”Submitted 0-Day Vulnerability on Log4j as a story · 127 points
HN discussionWhats wrong w/ nexus? https://blog.sonatype.com/using-nexus-3-as-your-repository-p... All our devs have our group repo configured as default. Any publishing is done to our private repo (via CI only) and any public package is pulled through the proxy repo, this way all packages are cached in our private repo so when npm registry goes down / someone unpublishes (which happens/ed?) our CI server doesn't die.
Comment linking /using-nexus-3-as-your-repository-part-2-npm-packages
on “Major bank accidentally published a private package to the public NPM Registry”Submitted ZeroTrustOps: Securing at Scale as a story · 25 points
HN discussion1. End-users don’t need to personally verify smart contracts or any other open source software. The key is to have each version have a hash, and on EVM thatms easy — it’s the address of the contract. Then, more and more auditors go through the code and sign off on the contract. In fact, this should be done for lots of open source ecosystems, eg composer or npm, because then we might not have stuff like this: https:/…
Comment linking /npm-project-used-by-millions-hijacked-in-supply-chain-attack
on “Chief scientist of major corporation can’t handle criticism of the work he hypes”Submitted NPM flooded with 748 packages that store movies as a story · 19 points
HN discussionMan Yue Mo worked at Semmle ( https://blog.sonatype.com/steps-to-responsible-disclosure ) before it was acquired by GitHub ( https://github.blog/2019-09-18-github-welcomes-semmle/ ). That research function has carried on as the GitHub Security Lab. Semmle built CodeQL, now offered by GitHub ( https://docs.github.com/en/code-security/code-scanning/intro... ), which GitHub and Microsoft (see https://www.microsoft.com/…
Comment linking /steps-to-responsible-disclosure
on “Gaining kernel code execution on an MTE-enabled Pixel 8”Submitted SSL Connectivity for all Central Repository users Underway as a story · 6 points
HN discussionHere is a good writeup of some of the pros and cons of using a "reachability" approach. https://blog.sonatype.com/prioritizing-open-source-vulnerabi... >Unfortunately, no technology currently exists that can tell you whether a method is definitively not called, and even if it is not called currently, it’s just one code change away from being called. This means that reachability should never be used as an excuse to c…
Comment linking /prioritizing-open-source-vulnerabilities-is-reachability-useful
on “Ignore 98% of dependency alerts: introducing Semgrep Supply Chain”Submitted Apache Servers Actively Exploited in the Wild and the Importance of Patching as a story · 4 points
HN discussion#1 here can be automated. My current employer sells one such solution, though there are of course others. Here is a blog post about the vulnerability from back when it was discovered earlier this year. http://blog.sonatype.com/2017-struts2-vulnerability-exploit-...
Comment linking /2017-struts2-vulnerability-exploit-speed-matters
on “Apache Struts Statement on Equifax Security Breach”Submitted Fake NPM Roblox API Package Installs Ransomware as a story · 3 points
HN discussion1) Glad we have a Nexus proxy in front of npm... [a] 2) Cloudflare strikes again, this one company is at the same time making the internet better and worse. I'm constantly blocked by cloudflare for something that should not be, it's extremely frustrating. Then when you complain to them they throw their hands up and say "owner hasn't configured their site for that". Ugh. [a] https://blog.sonatype.com/using-nexus-3-as…
Comment linking /using-nexus-3-as-your-repository-part-2-npm-packages
on “NPM: 429 Too Many Requests”Submitted Dependency Hijacking Software Supply Chain Attack Hits More Than 35 Orgs as a story · 3 points
HN discussionSonatype Lifecycle is designed to analyze a built package and figure out what's inside it, specifically when there aren't manifest files to tell you what's -supposed- to be there. It can obviously do a lot more, but the analysis is designed to solve the exact problem you're describing. https://blog.sonatype.com/mapping-the-javascript-genome-for-...
Comment linking /mapping-the-javascript-genome-for-devops
on “Ask HN: How do you security-audit external software using NPM packages?”Submitted Imposter Twilio NPM malware backdoors Linux machines as a story · 3 points
HN discussionProducts like Nexus Firewall[0] have settings to block suspicious packages. [0] https://blog.sonatype.com/sonatype-releases-new-nexus-firewa...
Comment linking /sonatype-releases-new-nexus-firewall-policy-to-secure-software-supply-chains-from-dependency-confusion-attacks
on “Malicious Python packages replace crypto addresses in developer clipboards”Submitted NPM packages caught exfiltrating Kubernetes config, SSH keys as a story · 2 points
HN discussionPlenty of examples of NPM packages being taken over: * https://www.whitesourcesoftware.com/resources/blog/npm-packa... * https://medium.com/@alex.birsan/dependency-confusion-4a5d60f... * https://blog.sonatype.com/npm-project-used-by-millions-hijac... * https://checkmarx.com/blog/attackers-write-bugs-as-well/ When was the last time you audited all of the libraries a SPA depended on? If it was during the last build, c…
Comment linking /npm-project-used-by-millions-hijacked-in-supply-chain-attack
on “A Summary of OAuth 2.0 Attack Methods”Submitted Stolen Information Stealers Are Fueling an Underground Market as a story · 2 points
HN discussionhttp://blog.sonatype.com/2009/04/nexus-133-introduces-automa...
Comment linking /2009/04/nexus-133-introduces-automatic-signature-verification-to-maven-artifacts/
on “Just-in-time packager for GitHub repositories”Submitted PyPI, NuGet, NPM Flooded with Roblox and Fortnite Spam: Why? as a story · 2 points
HN discussionFor Java (btw), there isn't a central repository, but Maven lets you download the Internet ( http://blog.sonatype.com/2011/04/how-not-to-download-the-int... ) which solves the same problem.
Comment linking /2011/04/how-not-to-download-the-internet/
on “Perl's Problems”Submitted Log4shell by the Numbers as a story · 2 points
HN discussionThis seems to be a yet another manifestation of the same underlying issue that has marred this library since 2013: https://blog.sonatype.com/jackson-databind-remote-code-execu... The only reliable fix is surely stopping serialization of arbitrary classes by not using or auditting any use of the DefaultTyping feature.
Comment linking /jackson-databind-remote-code-execution
on “Jackson-databind – remote code execution vulnerability”Submitted New PyPI Cryptomining Malware as a story · 2 points
HN discussion
