Checkmarx’ Approach to Software Supply Chain Security

2023 culminated with an intensified wave of attacks on the software supply chain. Here are just a few that our Software Supply Chain Research Team helped expose in the month of December alone: 

• North Korea used public open-source and private package poisoning via the GitHub platform to infiltrate organizations and compromise their software supply chains (report)

• Attackers published malicious packages to PyPl, using various tactics, including combining obfuscation with encryption/decryption methods to hide their malicious intent, employing fileless …

attacks checkmarx compromise december expose github korea north north korea organizations package platform poisoning private public research security software software supply chain software supply chain security supply supply chain supply chain security team