AI coding assistants are changing the economics of software development. They can interpret tasks, inspect codebases, select dependencies, make changes, call tools, run tests, and prepare pull ...

As we have spoken with Maven Central publishers about sustainability, one pattern has appeared repeatedly: a surprising amount of what reaches Central was never really intended for downstream ...

The European Union (EU) Cyber Resilience Act (CRA) is no longer a future-looking compliance project. Its first major operational deadline is now days away. Starting September 11, 2026, manufacturers ...

0:05 Welcome everyone to this episode of Open Source Open Mic. My name is Andrew Garrett and I work in product marketing here at Sonatype. I am pleased to be joined today with my guest Christopher ...

AI coding assistants can generate a working application in minutes. But without trusted dependency intelligence, they can also recommend vulnerable, malicious, or low-trust packages. Watch how ...

Note: This blog was initially published at 8:40pm ET on April 30. It was updated at 6:54pm ET on May 1 to include additional packages. Two malicious versions of the popular PyTorch Lightning package ...

The latest malware campaign uncovered by Sonatype researchers involved 176 malicious npm packages, many published with the exact same version number: 99.99.99. The versioning strategy was not subtle, ...

Over the past few years, Sonatype had consistently been on top of discovering malicious packages infiltrating open source ecosystems like npm, PyPI, and GitHub. Among various examples, this has ...

The Digital Operational Resilience Act (DORA) focuses on limiting how disruptive cyberattacks are to financial institutions. One of its key characteristics is that it views open source analysis, also ...

Last week was the second time I've attended Black Hat, the first being over a decade ago, and it has certainly grown. The production value of the briefings and especially the keynotes was incredible, ...

Organizations are absorbing a huge number of open source software (OSS). Open source comes with unique requirements that are becoming unwieldy to resolve. Companies are allowing licenses they should ...

At Sonatype, innovation knows no borders. We're excited to announce the opening of our new engineering hub in Hyderabad, India — a strategic milestone in our commitment to scale global innovation and ...