Google Open Source Security Team News Today

It is only a couple of weeks since the debut of the Microsoft AI Bounty Program, and now Google has launched its own bug bounty program specific to generative AI.

The Malicious Packages repository acts as a public database where reports of malicious packages are stored.

Announcing a new, more secure way to publish to PyPI

/PRNewswire/ -- The Open Source Security Foundation (OpenSSF) is proud to announce the release of version 1.0 of Supply-chain Levels for Software Artifacts...

SLSA v1.0 has been designed to make the software supply chain security framework more accessible and specific to areas of the software delivery lifecycle.

With the two new services, Google aims to help minimise risk from malicious code in the software supply chain.

With the two new services, Google aims to help minimize risk from malicious code in the software supply chain.

Sigstore is an open source project launched by Linux Foundation with the goal of providing free and stable services for all developers to easily sign, verify and protect their software projects. While code signing is a valuable tool to prevent hackers from co-opting patching systems and delivering malware, it is difficult to implement in open source projects given the complexity of key management.  

OSV-Scanner is a free vulnerability scanner that open source developers can use to check for vulnerabilities in their projects' dependencies.

Here's a comprehensive look at some of the lesser-known, but no less serious, types of software supply chain attacks.