News

Product news and updates from the Gastropod team.

16 Typosquatted RubyGems Packages Delivered a Windows Infostealer Through the Native Build Proces 27 Aug 2026 · Chris
Published on gastropod.io on 08-27-2026
vulnerability-intelligencesoftware-supply-chain-securityrubygemsrubycredential-thefttyposquatting
Fourteen npm Packages Working as intended (except for that pesky Linux Backdoor feature) 26 Aug 2026 · Chris
Published on gastropod.io on 08-26-2026
vulnerability-intelligencesoftware-supply-chain-securitynpmcredential-theftci-cd-securitymalware
GeoServer's SQL Injection Zero-Day Was Being Scanned For Within Hours of the (irresponsible) Disclosure 16 Aug 2026 · Chris
Published on gastropod.io on 08-16-2026
vulnerability-intelligencesoftware-supply-chain-securitymavenjavasql-injectionremote-code-execution
Nearly 800 npm Packages, AI-Generated Names, One Shared Backdoor: Inside WEL1DROPPER 15 Aug 2026 · Chris
Published on gastropod.io on 08-14-2026
vulnerability-intelligencesoftware-supply-chain-securitynpmmalwarecredential-thefttyposquatting
One Endpoint, Full Admin: Inside the Metabase Bug CISA Says to Patch ASAP 14 Aug 2026 · Chris
Published on gastropod.io on 08-14-2026
vulnerability-intelligencesoftware-supply-chain-securitysql-injectionbusiness-intelligenceself-hosted-softwarezero-day
14,090 Vulnerabilities in Two Months, and 99.4% of Them Have No CVE 7 Aug 2026 · Chris
Published on gastropod.io on 08-06-2026
vulnerability-intelligencesoftware-supply-chain-securityai-securityopen-sourcedependency-managementsbom
77 Counterfeit Open VSX Extensions, with a Config File That Keeps Installing The 6 Aug 2026 · Chris
Published on gastropod.io on 08-05-2026
software-supply-chain-securityvulnerability-intelligenceide-extensionsopen-vsxci-cd-securitycredential-theft
New npm compromise: The keyv Worm Published Releases That Had No Commit Behind Them 5 Aug 2026 · Chris
Published on gastropod.io - 08-05-2026
ApostropheCMS's Critical Auth Bypass 1 Aug 2026 · Chris
Published on gastropod.io on 08-01-2026
vulnerability-intelligencesoftware-supply-chain-securitynpmnode-jsprototype-pollutiontransitive-dependencies
No Login Required: TeamCity's Critical RCE and Your Build 1 Aug 2026 · Chris
Published on gastropod.io - 07-28-2026
vulnerability-intelligencesoftware-supply-chain-securityci-cd-securityremote-code-executionteamcityjetbrains
PyPI and GitHub Are Racing Against Time for Package Poisoning 29 Jul 2026 · Chris
Published on gastropod.io on 07-28-2026
software-supply-chain-securityvulnerability-intelligencepypipythonpackage-poisoningprovenance
fastjson 1.x CVE-2026-16723 - yikes! 25 Jul 2026 · Chris
Published on gastropod.io on 07-25-2026
vulnerability-intelligencesoftware-supply-chain-securitymavenjavaremote-code-executiondeserialization
Langflow's Fifth CIS-KEV CVE in a year 25 Jul 2026 · Chris
Published on gastropod.io on 07-24-2026
vulnerability-intelligencesoftware-supply-chain-securityci-cd-security
Borrowed Compute: How Ten Packagist Libraries Turned GitHub Actions Into an Attack Botnet 24 Jul 2026 · Chris
Published on gastropod.io on 07-23-2026
vulnerability-intelligencesoftware-supply-chain-securitycomposergithub-actionsci-cd-securitysbom
What the OpenAI/Hugging Face Breach Says About SBOM Blind Spots 23 Jul 2026 · Chris
Published on gastropod.io - 07-22-2026
vulnerability-intelligencesoftware-supply-chain-securitysbomai-securityprovenance
FakeGit: 7,600 Repos, 14 Million Downloads, and an AI Agent Reading the Attacker's README 23 Jul 2026 · Chris
Published on gastropod.io - 07-22-2026
agentbaitingsoftware-supply-chain-securityvulnerability-intelligencegithubai-agentsmcp
ViteVenom: expansion of the ChainVeil campaign 21 Jul 2026 · Chris
Published on gastropod.io - 07-21-2026
vulnerability-intelligencesbomsoftware-supply-chain-securitynpmcryptocredential-theft
Eleven Bytes, No CVE: The OpenSSL HollowByte Flaw That Scanners Miss 21 Jul 2026 · Chris
Published on gastropod.io - 07-20-2026
vulnerability-intelligencesoftware-supply-chain-securityopenssldenial-of-servicetlssbom
SleeperGem: Dormant RubyGems Accounts Reactivated to Deliver a Persistent Backdoor 20 Jul 2026 · Chris
Published on gastropod.io - 07-19-2026
Inside the Injective SDK Wallet-Key Theft 17 Jul 2026 · Chris
Published on gastropod.io - 07-17-2026
vulnerability-intelligencesoftware-supply-chain-securitynpmcredential-theftcrypto
Asyncapi NPM Supply Chain Attack 16 Jul 2026 · Chris
Published on gastropod.io on 07-16-2026
vulnerability-intelligencesoftware-supply-chain-securitynpmgithub-actionsprovenance
The npm Package That Only Turned Evil When You Used It 16 Jul 2026 · Chris
Published on gastropod.io - 07-15-2026
vulnerability-intelligencesoftware-supply-chain-securitynpmcredential-theftcrypto
Braintree.net nuget Typosquat 16 Jul 2026 · Chris
Published on gastropod.io - 07-15-2026
vulnerability-intelligencesoftware-supply-chain-securitynugetnettyposquattingpayment-fraud
Laravel lang tag rewrite supply chain attack 16 Jul 2026 · Chris
Published on gastropod.io on 07-15-2026
vulnerability-intelligencesoftware-supply-chain-securitycomposerpackagistphpcredential-theft
Paysafe/Skrill/Neteller fake SDK/Typosquat Campaign 16 Jul 2026 · Chris
Published on gastropod.io - 07-15-2026
vulnerability-intelligencesoftware-supply-chain-securitynpmpypityposquattingcredential-theft
The jscrambler npm Compromise 16 Jul 2026 · Chris
Published on gastropod.io - 7-15-2026
vulnerability-intelligencesoftware-supply-chain-securitynpmcredential-theftdependency-management
Inside the AsyncAPI "Miasma" Attack: When the Pipeline Itself Becomes the Attacker 16 Jul 2026 · Chris
Published on gastropod.io 7-15-2026
vulnerability-intelligencesoftware-supply-chain-securitysupply-chain-attacknpmci-cd-securitygithub-actions
gastropod - a superior alternative to Artifactory or Nexus 16 Jul 2026 · Chris
Gastropod.io is a superior alternative to JFrog Artifactory and Sonatype Nexus because it provides a unified software-supply-chain registry where every artifact leaves a comprehensive trail. Unlike…
nexus-replacementartifactory-replacement
gastropod is live! 15 Jul 2026 · Chris
---
day1releaseexciting
Introducing Gastropod 20 Jun 2026 · admin
Gastropod is an artifact registry that treats identity as the foundation, not an afterthought. Every package — whatever ecosystem it came from — is named by its Package URL:…