# snyk Snyk is an AI security company providing developer-first tooling and a security platform that finds and fixes issues across code, dependencies, containers, and cloud infrastructure. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## SHA1-Hulud, npm supply chain incident DevFeed: [SHA1-Hulud, npm supply chain incident]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2025-11-24T18:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [npm](), [snyk](), [vulnerability](), [GitHub Actions](), [CI/CD](), [GitHub](), [Self-hosted](), [Cloud](), [Amazon Web Services](), [Azure](), [Google Cloud Platform (GCP)]() Tags: [awareness](), [blog](), [ci](), [ci-cd](), [cloud](), [cloud-infrastructure](), [developer](), [devrel](), [github](), [github-actions](), [incident](), [npm](), [security](), [self-hosted](), [sha1-hulud](), [shai-hulud](), [snyk](), [supply-chain](), [supply-chain-security](), [trust](), [vulnerability](), [vulnerability-insights](), [worm]() ### AI overview Snyk reports SHA1-Hulud, a second-wave npm supply chain attack and worm that spreads through trojanized packages with hidden preinstall scripts. The worm can compromise GitHub Actions self-hosted runners, inject malicious workflows, execute remote commands, exfiltrate GitHub and npm secrets, and search for AWS, Azure, and GCP credentials. Snyk identified more than 600 impacted npm packages and is retesting customer assets, notifying affected customers, and updating its vulnerability databases. ### Source excerpt Snyk identified a new supply chain attack in the npm ecosystem, referred to as SHA1-Hulud. We believe this is a second wave of the Shai-Hulud attack. Learn what this attack is and how Snyk is responding. ## Anthem Awards 2025: Snyk Learn Recognized for Commitment to Secure AI Development DevFeed: [Anthem Awards 2025: Snyk Learn Recognized for Commitment to Secure AI Development]() Original publisher: [Read original article]() Author: Michael Biocchi Published: 2025-11-19T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk-learn](), [snyk](), [Security](), [Vulnerabilities](), [AI Development](), [Learning](), [Development]() Tags: [2025](), [ai](), [ai-development](), [awards](), [awareness](), [blog](), [developer](), [education](), [security](), [snyk](), [snyk-learn](), [vulnerabilities]() ### AI overview Snyk Learn was recognized as a Silver Winner in the Responsible Technology: Education or Literacy Platform category at the 2025 Anthem Awards. The free platform helps developers understand, identify, and fix code vulnerabilities through bite-sized lessons, interactive examples, and real-world scenarios, including guidance for secure AI development. ### Source excerpt We are incredibly proud and excited to announce that Snyk Learn has been recognized as a Silver Winner in the Responsible Technology: Education or Literacy Platform category at the 5th annual Anthem Awards! ## Secure by Design: The Future of Threat Modeling for AI-Native Applications DevFeed: [Secure by Design: The Future of Threat Modeling for AI-Native Applications]() Original publisher: [Read original article]() Author: John Carione Published: 2025-11-11T05:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Security for AI](), [Architecture & Design](), [Artificial Intelligence](), [snyk](), [Vulnerabilities](), [prompt injection]() Tags: [agentic](), [ai](), [prompt-injection](), [secure-by-design](), [security](), [security-for-ai](), [snyk]() ### AI overview This Snyk article argues that traditional, manual threat modeling cannot keep pace with AI-native applications built from large language models, autonomous agents, APIs, and changing data flows. It presents continuous, automated, AI-assisted threat modeling as a way to maintain secure-by-design systems and address risks such as prompt injection, data exfiltration, data poisoning, and agentic vulnerabilities. ### Source excerpt Explore how Snyk's Evo Threat Modeling Agent automates and contextualizes security for AI-native applications, addressing prompt injection, data exfiltration, data poisoning, and agentic vulnerabilities. ## Snyk Studio brings security scanning and automated fixes to Factory's Droids DevFeed: [Snyk Studio brings security scanning and automated fixes to Factory's Droids]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2025-11-05T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [Security](), [AI Development](), [Vulnerabilities](), [Model Context Protocol]() Tags: [2025](), [agentic](), [agentic-security](), [ai](), [awareness](), [blog](), [code-security](), [developer](), [model-context-protocol](), [partnership](), [related-content](), [security](), [snyk](), [vulnerabilities]() ### AI overview Snyk announces a partnership with Factory to bring Snyk Studio's real-time security intelligence into Factory Droid workflows through the Model Context Protocol. The integration is designed to help Droids identify and remediate vulnerabilities in newly generated code and reduce existing security debt using prioritized vulnerability data. ### Source excerpt Snyk is thrilled to announce our partnership with Factory, which brings Snyk Studio directly into Droid workflows. ## DevSecCon 2025 Recap: Securing the AI Revolution Together DevFeed: [DevSecCon 2025 Recap: Securing the AI Revolution Together]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-10-22T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Artificial Intelligence](), [DevSecOps](), [snyk](), [Application Security](), [Security](), [ide](), [Pull Request](), [snyk-code](), [Development]() Tags: [2025](), [ai](), [also](), [blog](), [developer](), [devops](), [devsecops](), [ide](), [interest](), [pmm](), [secure-software](), [security](), [snyk](), [snyk-code](), [snyk-open-source](), [snyk-platform]() ### AI overview This DevSecCon 2025 recap examines how AI is changing software development and security. It covers AI-accelerated DevSecOps, securing code from the first prompt, and managing AI-native application chaos with Evo by Snyk. The article also highlights Snyk capabilities for IDEs, pull requests, Snyk Code, and AppSec governance. ### Source excerpt AI is changing development. Our DevSecCon 2025 recap covers the 3 critical stages: AI-Accelerated DevSecOps, securing code at the first prompt, and taming AI-native app chaos with Evo by Snyk. ## Why We Built Evo -- From My Heart DevFeed: [Why We Built Evo -- From My Heart]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2025-10-22T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Securing AI](), [ai security](), [Application Security](), [Cybersecurity](), [snyk](), [Artificial Intelligence](), [Architecture & Design]() Tags: [acquisition](), [agentic-ai](), [agentic-security](), [ai](), [ai-security](), [awareness](), [blog](), [cybersecurity](), [developer](), [llm](), [mcp](), [security](), [snyk](), [snyk-platform]() ### AI overview Snyk introduces Evo as an agentic security orchestrator for AI-native software systems. The article argues that AI security must be an autonomous, operational, continuous architecture integrated into development rather than a passive collection of scanners, policies, or dashboards. ### Source excerpt Introducing Evo by Snyk, the world's first Agentic Security Orchestrator. Learn why Evo is changing the game in cybersecurity to make security seamless, invisible, intelligent, and unstoppable--so innovation never has to slow down again. ## Increasing Agility & Flexibility: How Mercato Solutions tackles the application security vs. flexibility conundrum with Snyk DevFeed: [Increasing Agility & Flexibility: How Mercato Solutions tackles the application security vs. flexibility conundrum with Snyk]() Original publisher: [Read original article]() Author: Nina McClure Published: 2025-10-16T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Low code](), [snyk](), [Web](), [Cloud]() Tags: [application-security](), [awareness](), [blog](), [cloud](), [customer](), [devops](), [low-code](), [security](), [snyk](), [snyk-platform](), [web]() ### AI overview This customer article explains how Mercato Solutions, a low-code enterprise application provider, works with Snyk to address application security challenges while preserving the flexibility of its cloud-first platform. The article highlights the security risks of headless infrastructure, the resulting attack surface, and Mercato's goal of maintaining strong security with a small team. ### Source excerpt Learn how Mercato Solutions, a fast-growing low-code application provider, achieved near-zero security incidents and maintained development flexibility by partnering with Snyk API & Web. ## Snyk Named a Leader in the 2025 Forrester SAST Wave: SAST Solutions, Q3 2025 DevFeed: [Snyk Named a Leader in the 2025 Forrester SAST Wave: SAST Solutions, Q3 2025]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-09-09T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [Application Security](), [Testing](), [Securing AI](), [Developer experience](), [Vulnerabilities]() Tags: [2025](), [ai](), [ai-security](), [application-security](), [awareness](), [blog](), [code-security](), [developer-experience](), [executive](), [recognition](), [sast](), [snyk](), [vulnerabilities]() ### AI overview Snyk announces that Forrester recognized it as a Leader in the 2025 Forrester Wave for Static Application Security Testing Solutions. The article attributes this position to Snyk's innovation, AI Security Platform, developer experience, enterprise analytics and visibility, broad Application Security Testing capabilities, and customer impact. It also highlights AI-powered prioritization, autonomous fixes, and the role of Snyk in shift-left security strategies. ### Source excerpt We're excited to announce that Snyk has been recognized as a Leader in the Forrester Wave™: Static Application Security Testing (SAST) Solutions, Q3 2025. ## Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk DevFeed: [Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk]() Original publisher: [Read original article]() Author: Phoebe Nerdahl Published: 2025-08-07T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [ai security](), [AI Strategy](), [AI Development](), [Security](), [Vulnerabilities](), [AI Platform](), [GitHub](), [Terraform]() Tags: [agentic-ai-security](), [ai](), [ai-adoption](), [ai-infrastructure](), [ai-security](), [awareness](), [blog](), [compliance](), [devops](), [executive](), [github](), [government](), [nist](), [sboms](), [secure-by-design](), [security](), [self-hosted](), [snyk](), [snyk-platform](), [terraform](), [vulnerabilities]() ### AI overview This article explains how Snyk for Government helps federal agencies adopt AI securely through secure-by-design development, continuous vulnerability management, compliance support, automation, and governance. It highlights integrations across developer workflows, FedRAMP authorization, standards-aligned practices, and the Snyk AI Trust Platform. ### Source excerpt Learn how Snyk for Government helps federal agencies meet AI mandates with confidence. Snyk's AI Trust Platform ensures secure-by-design development, compliance, and transparent AI systems. ## Fixing Fix Fatigue: Building Developer Trust for Secure AI Code DevFeed: [Fixing Fix Fatigue: Building Developer Trust for Secure AI Code]() Original publisher: [Read original article]() Author: Ezra Tanzer Published: 2025-06-30T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Securing AI](), [Artificial Intelligence](), [Vulnerabilities](), [ai-coding](), [GitHub Copilot](), [snyk]() Tags: [ai](), [ai-security](), [application-security](), [blog](), [code-security](), [developer](), [devops](), [github-copilot](), [interest](), [productivity](), [security](), [security-vulnerabilities](), [snyk]() ### AI overview This article explains how AI coding assistants increase developer productivity while introducing security risks, including vulnerabilities in AI-generated code. It argues that security tools must build developer confidence through verified fixes, real-time scanning, and workflows that reduce friction and alert fatigue. ### Source excerpt Build developer trust in AI security tools with verified fixes, real-time scanning, and frictionless workflows powered by Snyk Agent Fix. ## Why AI Trust Will Shape Your Next Decade of Software Development DevFeed: [Why AI Trust Will Shape Your Next Decade of Software Development]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2025-06-24T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Artificial Intelligence](), [AI Development](), [Securing AI](), [snyk](), [Security](), [sdlc](), [Platform Engineering](), [AI Strategy](), [prompt injection](), [Large Language Model]() Tags: [2025](), [agentic](), [ai](), [ai-adoption](), [ai-security](), [ai-transparency](), [automation](), [blog](), [code-security](), [compliance](), [developer](), [development](), [engineering](), [governance](), [interest](), [llm](), [platform-engineering](), [prompt-injection](), [risk-management](), [sdlc](), [security](), [snyk](), [snyk-platform](), [software-development](), [speed](), [trust]() ### AI overview The article argues that AI trust is foundational for safe, scalable software development as organizations adopt AI and agentic workflows. It describes AI trust as maintaining control, visibility, security, governance, and continuous risk management while benefiting from faster delivery, greater productivity, and automation. It highlights risks including insecure AI-generated code, prompt injection, data exfiltration, model manipulation, and misconfiguration, and presents Snyk's AI Security Platform as a way to embed risk management and security into the SDLC. ### Source excerpt Discover why AI Trust is crucial for secure, scalable software development in the AI era. Learn how Snyk's AI Security Platform helps you manage risk, enforce policies, and ensure continuous compliance. ## Building AI Trust with Snyk Code and Snyk Agent Fix DevFeed: [Building AI Trust with Snyk Code and Snyk Agent Fix]() Original publisher: [Read original article]() Author: Liqian Lim (林利蒨); Brendan Hann Published: 2025-06-23T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [snyk-code](), [ai security](), [Application Security](), [ai-governance](), [Securing AI](), [Pull Request](), [ide]() Tags: [ai](), [ai-coding](), [ai-governance](), [ai-security](), [application-security](), [auto-remediation](), [autonomous](), [blog](), [code-security](), [compliance](), [developer](), [devops](), [engineering](), [pmm](), [pull-requests](), [sast](), [security](), [snyk](), [snyk-code](), [snyk-platform]() ### AI overview Snyk describes its AI Security Platform, Snyk Code, and Snyk Agent Fix for governing AI-assisted development. Snyk Agent Fix autonomously generates and validates code-security fixes, offering auto-remediation in IDEs and pull requests, while Snyk Code provides SAST, visibility, prioritization, and policy controls. ### Source excerpt Secure and accelerate your adoption of AI coding with pre-screened auto-fixes and autonomous code security for modern, developer-loved SAST. ## Announcing a Dedicated Snyk API & Web Infrastructure Instance for Asia-Pacific DevFeed: [Announcing a Dedicated Snyk API & Web Infrastructure Instance for Asia-Pacific]() Original publisher: [Read original article]() Author: Snyk Team Published: 2025-06-16T23:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [API](), [Web](), [Application Security](), [Security, Privacy and Abuse Prevention](), [Latency]() Tags: [ai](), [announce](), [apac](), [api](), [application-security](), [awareness](), [blog](), [community](), [compliance](), [data-privacy](), [developer](), [devops](), [executive](), [latency](), [launch](), [sdlc](), [security](), [shift-left](), [snyk](), [web]() ### AI overview Snyk has launched a dedicated Snyk API & Web infrastructure instance hosted locally in the Asia-Pacific region. The instance supports regional data residency and compliance requirements, reduces latency, and provides DAST capabilities for identifying runtime vulnerabilities in the context of AI-driven development. ### Source excerpt Snyk is delighted to announce a significant milestone for our customers and partners in the Asia-Pacific region: the launch of a dedicated Snyk API & Web infrastructure instance, which is now available and hosted locally within the region. ## Snyk for Government Achieves FedRAMP Moderate Authorization: A Milestone for Secure Government Software DevFeed: [Snyk for Government Achieves FedRAMP Moderate Authorization: A Milestone for Secure Government Software]() Original publisher: [Read original article]() Author: Danny Allan Published: 2025-06-05T23:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [Application Security](), [Vulnerabilities]() Tags: [ai](), [application-security](), [awareness](), [blog](), [engineering](), [executive](), [fedramp](), [government](), [security](), [snyk](), [snyk-platform](), [vulnerabilities]() ### AI overview Snyk announced that Snyk for Government has received FedRAMP Moderate authorization for U.S. public-sector use. The company says the offering supports vulnerability detection, remediation guidance, policy enforcement, developer-tool integrations, and compliance reporting. ### Source excerpt Snyk for Government is our FedRAMP Moderate authorized solution for the public sector. This authorization underscores our unwavering commitment to providing secure development solutions that meet the rigorous standards of the Federal Risk and Authorization Management Program (FedRAMP). ## Welcome to Snyk Labs: Charting the Course for AI-Native Security DevFeed: [Welcome to Snyk Labs: Charting the Course for AI-Native Security]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2025-05-28T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Securing AI](), [ai security](), [snyk](), [AI Development](), [LLM security](), [vulnerability](), [Monitoring]() Tags: [2025](), [agents](), [ai](), [ai-development](), [ai-security](), [awareness](), [blog](), [cosai](), [developer](), [large-language-models-llms](), [llm-security](), [monitoring](), [security](), [security-labs](), [snyk](), [vulnerability]() ### AI overview Snyk introduces Snyk Labs, an innovation and research arm focused on helping developers and security leaders address emerging risks in AI-native applications. The hub will publish technical demos, prototypes, research, analysis of AI threats and standards, and experiments. Its work includes AI Security Posture Management, an AI Bill of Materials, a GenAI Model Risk Registry, vulnerability research, continuous monitoring of AI behavior, and contributions to LLM security standards with OWASP and CoSAI. ### Source excerpt Discover Snyk Labs, Snyk's AI security resource hub for the latest technical demos, sharing emerging threats and standards, & early insights into the AI security landscape. ## Driving AI Security Innovation: Snyk Enhances Global Channel & GSI Partner Program DevFeed: [Driving AI Security Innovation: Snyk Enhances Global Channel & GSI Partner Program]() Original publisher: [Read original article]() Author: Cyndi Doyle Published: 2025-05-08T04:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [ai security](), [snyk](), [Application Security](), [DevSecOps](), [Generative AI](), [Development]() Tags: [ai](), [ai-security](), [application-security](), [awareness](), [blog](), [cybersecurity](), [devsecops](), [executive](), [generative-ai](), [partners](), [partnerships](), [snyk](), [snyk-platform](), [updates]() ### AI overview Snyk describes updates to its Global Channel & GSI Partner Program, including formalized go-to-market programs, revised resale discounts, marketing development funds, co-marketing planning, and enhanced partner enablement. The changes emphasize strategic collaboration and AI Security opportunities. ### Source excerpt Discover Snyk's enhanced Partner Program for AI Security. Drive growth with optimized discounts, MDF, new GTM programs & dedicated support for mutual success. ## Secure AI-Generated Code at Speed with Snyk and ServiceNow DevFeed: [Secure AI-Generated Code at Speed with Snyk and ServiceNow]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2025-05-01T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI-assisted coding](), [Application Security](), [Security](), [snyk](), [AI Development](), [Development]() Tags: [ai](), [ai-assisted-coding](), [application-security](), [automated](), [blog](), [code](), [code-security](), [development](), [executive](), [interest](), [related-content](), [security](), [snyk](), [snyk-code](), [workflows]() ### AI overview The article examines the security risks of AI-generated code and presents the Snyk and ServiceNow partnership as a way to combine AI-powered developer security with enterprise workflow automation. It emphasizes real-time feedback, vulnerability prioritization, remediation tracking, and automated fixes to help application security teams manage the scale and speed of AI-assisted coding. ### Source excerpt Explore the security risks of AI-generated code and how Snyk & ServiceNow offer AI-powered developer security integrated with enterprise workflows for effective remediation. ## Snyk launches Snyk API & Web, a dynamic application security testing solution DevFeed: [Snyk launches Snyk API & Web, a dynamic application security testing solution]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2025-04-22T12:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [snyk](), [API](), [Development](), [Web](), [Application Security](), [Vulnerabilities](), [AI Development](), [Generative AI]() Tags: [agentic-ai](), [ai](), [ai-development](), [ai-security](), [api](), [application-security](), [awareness](), [blog](), [customer-featured](), [developer](), [devops](), [executive](), [pmm](), [security](), [snyk](), [vulnerabilities](), [web]() ### AI overview Snyk announces Snyk API & Web, a dynamic application security testing solution integrated with its Developer Security Platform. The article says it combines Probely's DAST technology with Snyk's SAST, SCA, container, and infrastructure-as-code security engines to address security challenges in modern applications, including APIs connecting applications and large language models. ### Source excerpt Snyk launches Snyk API & Web, an AI-driven DAST engine that helps organizations automatically find and expose vulnerabilities at scale. Deeply integrated in Snyk's Developer Security Platform, Snyk API & Web is the company's answer to securing the complex, AI-powered applications developers are building today. ## Snyk Partners with Nova8 to Empower Secure Development Across Latin America DevFeed: [Snyk Partners with Nova8 to Empower Secure Development Across Latin America]() Original publisher: [Read original article]() Author: Michael Daniels Published: 2025-04-15T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [Development](), [Cybersecurity](), [Security](), [Vulnerabilities](), [Cloud](), [DevOps](), [Architecture & Design](), [Open Source]() Tags: [application-security](), [awareness](), [blog](), [cloud-native](), [cybersecurity](), [developer](), [developer-security-platform](), [developers](), [devops](), [external](), [open-source](), [partners](), [partnership](), [security](), [snyk](), [snyk-code](), [snyk-container](), [snyk-iac](), [vulnerabilities]() ### AI overview Snyk announces a strategic partnership with Nova8 to expand developer security adoption across Latin America. The partnership combines Snyk's developer security platform with Nova8's regional distribution, implementation, training, customization, and channel-partner expertise to help organizations identify and fix application vulnerabilities earlier. ### Source excerpt Snyk joins forces with cybersecurity distributor Nova8 to accelerate developer security adoption in Latin America. See how the partnership helps reduce risk. ## Snyk Security Solution Now Integrated into Google Cloud's Gemini Code Assist DevFeed: [Snyk Security Solution Now Integrated into Google Cloud's Gemini Code Assist]() Original publisher: [Read original article]() Author: Liqian Lim (林利蒨) Published: 2025-04-09T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [Artificial Intelligence](), [Application Security](), [code security](), [ide](), [AI Development]() Tags: [ai](), [application-security](), [awareness](), [blog](), [code-security](), [executive](), [gemini](), [google](), [pmm](), [related-content](), [sast](), [snyk](), [snyk-apprisk](), [snyk-code]() ### AI overview Snyk's security solution is integrated into Google Cloud's Gemini Code Assist, enabling developers to use Snyk security capabilities through natural-language prompts and the coding assistant's chat interface. ### Source excerpt Secure AI coding with Snyk and Google Gemini. Learn how Snyk Code's SAST integrates with Gemini Code Assist for seamless, secure development workflows. ## Q&A Session with Snyk & John Hammond: Your Fetch the Flag Questions, Answered DevFeed: [Q&A Session with Snyk & John Hammond: Your Fetch the Flag Questions, Answered]() Original publisher: [Read original article]() Author: Taylor Macomber; Gina Fitzpatrick Published: 2025-04-01T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [ctf](), [Cybersecurity](), [snyk](), [JavaScript](), [math]() Tags: [blog](), [community](), [ctf](), [cybersecurity](), [developer](), [event](), [interest](), [python](), [q-a](), [snyk](), [snyk-learn]() ### AI overview This article presents a live Q&A following Snyk's Fetch the Flag CTF event. Cybersecurity educator John Hammond, challenge designer Matt Kiely, and developer advocates answer questions about getting started with CTFs, collaborating with the security community, using Netcat and pwntools, and automating challenge interactions with Python socket tools. It also introduces a challenge involving JavaScript's Math.random() and discusses securely using generative AI coding tools. ### Source excerpt Here are five standout questions and answers from Snyk's Fetch the Flag CTF event on February 27 and 28. Sit down with cybersecurity educator and developer influencer John Hammond--along with challenge designer Matt Kiely (aka huskyhacks), and developer advocates Micah Silverman, Sonya Moisset, Vandana Verma, and Elliot Ward--for a live Q&A session. ## Lottie Player npm package compromised for crypto wallet theft DevFeed: [Lottie Player npm package compromised for crypto wallet theft]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-10-31T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [Vulnerabilities](), [Cryptocurrency](), [snyk](), [Security](), [supply-chain-security](), [Command-line interface]() Tags: [awareness](), [blog](), [cli](), [code-security](), [crypto](), [dependency](), [developer](), [devrel](), [incident](), [npm](), [package-compromise](), [security](), [snyk](), [snyk-code](), [supply-chain](), [vulnerabilities]() ### AI overview The @lottiefiles/lottie-player npm package was compromised after an npm registry publishing token was exposed. Malicious code in versions 2.0.5, 2.0.6, and 2.0.7 attempted to prompt users to connect cryptocurrency wallets. Those versions were removed, and version 2.0.8 restored the safe project code. The article explains how to use Snyk Dependency Reports and the Snyk CLI to identify affected projects and vulnerable dependencies. ### Source excerpt On October 31st, 2024, another package compromise and cryptocurrency hijack story unfolded for a popular npm package. Scan open source dependencies and container images in the CLI or your SCM with Snyk to determine if you're using one of the vulnerable versions of lottie-player, and potentially uncover any other security vulnerabilities you may have in your projects. ## Best practices for continuous vulnerability management DevFeed: [Best practices for continuous vulnerability management]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-10-29T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [vulnerability management](), [Application Security](), [supply-chain-security](), [Cybersecurity](), [DevSecOps](), [AI-assisted coding](), [snyk](), [developer tooling](), [npm]() Tags: [ai](), [application-security](), [awareness](), [best-practices](), [blog](), [container-security](), [devrel](), [devsecops](), [llm](), [open-source](), [open-source-security](), [pycharm](), [python](), [security](), [shift-left](), [snyk](), [snyk-code](), [snyk-container](), [snyk-learn](), [snyk-open-source](), [software-development](), [supply-chain](), [visual-studio-code](), [vs-code](), [vulnerability-insights](), [vulnerability-management]() ### AI overview This article presents continuous vulnerability management as essential for addressing risks from open-source dependencies, supply chain incidents, AI-generated code, and emerging cybersecurity threats. It recommends building a proactive security culture, integrating security throughout the software development lifecycle, providing ongoing training and awareness, and automating security workflows across DevOps and DevSecOps teams. It also advocates shift-left security through tools such as Snyk Code in IDEs including Visual Studio Code and Pycharm. ### Source excerpt By integrating security practices into the development lifecycle, providing continuous education and training, and automating security workflows, organizations can effectively mitigate risks from open-source supply chain incidents, AI-generated code, and emerging threats. Snyk provides the tools and resources to establish a proactive security culture and ensure application security. ## Snyk announces commitment to Service for America, bringing security education access to all DevFeed: [Snyk announces commitment to Service for America, bringing security education access to all]() Original publisher: [Read original article]() Author: Michael Biocchi Published: 2024-10-17T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [snyk-learn](), [Cybersecurity](), [Learning](), [AdventureX 2026]() Tags: [application-security](), [awareness](), [blog](), [capture](), [code-security](), [ctf](), [cybersecurity](), [developer](), [devops](), [devsecops](), [education](), [executive](), [free](), [government](), [learn](), [open-source-security](), [pmm](), [security](), [snyk](), [snyk-code](), [snyk-learn](), [snyk-open-source](), [teams](), [training](), [workshops]() ### AI overview Snyk announces its commitment to the Service for America Initiative by providing free cybersecurity education through Snyk Learn. The platform offers interactive lessons, learning paths, resources, and a Capture the Flag 101 workshop for students to help developers, security teams, and aspiring professionals build practical skills for secure software development. ### Source excerpt Snyk partners with the Service for America Initiative to offer free cybersecurity education through Snyk Learn. Discover Snyk Learn's free, hands-on training and workshops designed to equip developers and security teams with the skills to build secure applications. From coding security to Capture the Flag events, Snyk helps prepare students and professionals for the ever-evolving cyber landscape. [Next page]()