This Week in Malware—Ongoing Dependency Confusion

This week in malware, Sonatype's automated malware detection systems have flagged over four dozen packages on both the npm and PyPI registries. Most of these packages are dependency confusion candidates published as proof-of-concept (PoC) exercises by security enthusiasts and bug bounty hunters.

dependency dependency confusion devzone malware malware prevention npm pypi this week in malware vulnerabilities