Supply Chain Security
Poisoned Java library pulled after deserialisation backdoor found
A maintainer account takeover led to a release that executed attacker gadget chains on startup.
/ 5 min read
In briefA maintainer account takeover led to a release that executed attacker gadget chains on startup.
The malicious release was live for 31 hours and downloaded about 9,000 times.
Teams that pin dependency versions and verify signatures were not affected.
Filed under Risk ManagementSupply Chain Security
Does this story affect you?
Tell us about your environment and a SentriXa security editor will get back to you within one business day.