网络安全研究人员在npm注册表中发现了36个恶意包，这些包伪装成Strapi CMS插件，但携带不同的有效载荷，用于Redis和PostgreSQL利用、部署反向Shell、收集凭据并投放持久化植入程序。

Wasm, PGlite, OPFS, and other new tech bring robust data storage to the browser, Electrobun brings Bun to desktop apps, ...

Strapi plugins exploit Redis and PostgreSQL via postinstall scripts, enabling persistent access and data theft.

Compliance continues to drive adoption of trusted open source: We saw the same themes from December present here, underscored ...

EDB Postgres ...

Proprietary warehouses delivered scale — but at the cost of control, predictable pricing, and real flexibility. Enterprises are doing the math.

The web framework IHP 1.5.0 brings a new database layer, significant performance gains, and an improved modular architecture.

After hacking Trivy, TeamPCP moved to compromise repositories across NPM, Docker Hub, VS Code, and PyPI, stealing over 300GB ...

Threat actors abused trusted Trivy distribution channels to inject credential‑stealing malware into CI/CD pipelines worldwide ...

Supply chain attacks feel like they're becoming more and more common.

针对流行扫描工具Trivy的供应链攻击背后的威胁行为者疑似正在进行后续攻击，导致大量npm包遭到一种名为CanisterWorm的自传播蠕虫感染。该恶意软件利用ICP容器作为命令控制服务器的死信箱解析器，这是首次公开记录的滥用ICP容器获取C2服务器的案例。受影响的包包括EmilGroup和opengov范围内的多个包。感染链通过postinstall钩子执行加载器，投放Python后门联系ICP ...

AWS终止PostgreSQL 13标准支持，要求用户升级到版本14或更高版本。然而PostgreSQL 14的新认证方案导致AWS Glue服务无法正常工作，出现"不支持认证类型10"错误。这一兼容性问题自2021年就已存在，但两个服务团队缺乏协调。用户面临三种糟糕选择：降级数据库安全性、禁用连接测试功能或重写ETL工作流。继续使用旧版本需支付高昂的扩展支持费用。