Top all-time · #3763
Checkmarx
Company blog · checkmarx.com/blogsecurityprogramming
Checkmarx is the company blog at checkmarx.com, writing about security and programming. Since 2009, 21 different Hacker News readers have linked it 25 times, most often “Over 170K Users Affected by Attack Using Fake Python Infrastructure”. It has a working feed you can follow.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
HN commenters link Checkmarx's blog as a source for software supply-chain attack reports, including the 170k-user Python attack, malicious npm packages, Dependabot spoofing and OAuth attack methods. No comment judges the writing itself.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Checkmarx agentic application security software platform Combines Hybrid scanning, AI-powered agents, and unified risk intelligence across every attack surface
Most-linked posts?
- Over 170K Users Affected by Attack Using Fake Python Infrastructure3 people · 4 mentions · first linked 2024-03-25
- Malicious Python Package Targets macOS Developers to Access Their GCP Accounts2 people · 2 mentions · first linked 2024-07-26
What Hacker News says?
Kinda relevant, as I saw few comments about how safer languages are the solution. Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1]. [0] - https://github.com/c-skills/rust1 [1] - https://checkmarx.com/blog/over-170k-users-affected-by-attac...
Comment linking /blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure/
on “Backdoor in upstream xz/liblzma leading to SSH server compromise”Submitted Over 170K Users Affected by Attack Using Fake Python Infrastructure as a story · 3 points
HN discussionCheckmarx | Solution Architect / Professional Services | Remote (North America, EMEA, APAC) | Full-time Checkmarx builds application security testing tools. Our professional services team helps customers implement them. We're a globally distributed remote team with backgrounds across application development, DevOps, SRE, and AppSec. We come from many industries - but the one thing we have in common is we're passiona…
Comment linking /job-openings/
on “Ask HN: Who is hiring? (May 2022)”Submitted Attackers Planted a Telegram-Powered Backdoor Across Fake Pyrogram Packages as a story · 2 points
HN discussionA couple that I know of which are based on the security side of things are Brakeman ( https://github.com/presidentbeef/brakeman ) and Scanny ( https://github.com/openSUSE/scanny ) on the open source side. On the commercial side I know Checkmarx covers rails ( http://www.checkmarx.com/ ), amongst other languages
Comment linking /
on “John Carmack on Static Code Analysis”Submitted Malicious Python Package Targets macOS Developers to Access Their GCP Accounts as a story · 2 points
HN discussionOne of the big companies in corporate security compliance is literally called Checkmarx. They couldn't be any more honest about it. https://www.checkmarx.com/
Comment linking /
on “They want us to be compliant, not secure”Submitted Malicious Python Package Targets macOS Developers to Access Their GCP Accounts as a story · 2 points
HN discussionThis reminds me of a presentation on regular expression DoS attacks: http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWAS... [pdf] Quick view: https://docs.google.com/gview?url=http%3A%2F%2Fwww.checkmarx... P. S. Corrected wording.
Comment linking /Upload/Documents/PDF/Checkmarx_OWASP_IL_2009_ReDoS.pdf
on “Critical Django security updates released (0day, exploit in the wild)”Submitted Over 170K Users Affected by Attack Using Fake Python Infrastructure as a story · 2 points
HN discussionPlenty of examples of NPM packages being taken over: * https://www.whitesourcesoftware.com/resources/blog/npm-packa... * https://medium.com/@alex.birsan/dependency-confusion-4a5d60f... * https://blog.sonatype.com/npm-project-used-by-millions-hijac... * https://checkmarx.com/blog/attackers-write-bugs-as-well/ When was the last time you audited all of the libraries a SPA depended on? If it was during the last build, c…
Comment linking /blog/attackers-write-bugs-as-well/
on “A Summary of OAuth 2.0 Attack Methods”Submitted The Vibe Coding Hangover as a story · 1 points
HN discussionNot hypothetical: https://checkmarx.com/zero-post/exploiting-markdown-injectio...
Comment linking /zero-post/exploiting-markdown-injection-in-ai-agents-microsoft-copilot-chat-and-google-gemini/
on “Don't run OpenClaw on your main machine”Submitted When "Everything" Goes Wrong: NPM Dependency-Hell Campaign – 2024 Edition as a story · 1 points
HN discussionThe original source appears to be https://checkmarx.com/blog/surprise-when-dependabot-contribu...
Comment linking /blog/surprise-when-dependabot-contributes-malicious-code/
on “Hackers are spoofing themselves as GitHub's Dependabot to steal user passwords”Submitted Python Obfuscation Traps as a story · 1 points
HN discussionWould https://checkmarx.com/blog/how-npm-packages-were-used-to-spr... be a better URL? The current URL ( https://www.scmagazine.com/analysis/devops/npm-repository-15... ) seems like a summary of the original.
Comment linking /blog/how-npm-packages-were-used-to-spread-phishing-links/
on “NPM repository flooded with 15,000 phishing packages”Submitted Stop the Neglect - Scan Your Source Code Before You Regret - Checkmarx as a story · 1 points
HN discussionIn agreement with frodd above. Dependencies and supply chain attacks are probably the greatest risk to a lot of software orgs, as they run them across all their environments: Development (with secrets and other valuable artefacts on developer VMs), CI/CD pipelines which may have access tokens to production (and other) environments, and production itself. Notably even security companies are being impacted by this[0].…
Comment linking /zero-post/python-pypi-supply-chain-attack-colorama/
on “Vulnerability Reports are not Special Anymore”Submitted Key Takeaways from the Department of Energy Breach as a story · 1 points
HN discussionThe Side Channel Attack? JavaScript Zero: real JavaScript, and zero side-channel attacks https://blog.acolyer.org/2018/03/13/javascript-zero-real-jav... Side-Channel Attacks on Everyday Applications https://github.com/defuse/flush-reload-attacks The DrK (De-randomizing Kernel ASLR) attack https://github.com/sslab-gatech/DrK Cache Template Attacks https://github.com/IAIK/cache_template_attacks Using Node.js Event Loo…
Comment linking /knowledge/knowledgebase/XFS
on “Ask HN: Secure Webassembly crypto?”Submitted PHP vs. Python vs. Ruby as a story · 1 points
HN discussionSource article: https://checkmarx.com/blog/over-170k-users-affected-by-attac...
Comment linking /blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure/
on “Top Python Developers Hacked in Sophisticated Supply Chain Attack”
