More and more often popular software packages are compromised, leading to stolen api keys, tokens, secrets, etc...

Such packages can be used by thousands of companies with different maturity levels in cyber-security.

Take one recent case of Trivy, a popular tool used to detect... wait for it... security vulnerabilities.

Recently it got infected with malicious code, even had several production-ready versions released to anyone using it's open-source version. (see the irony?)

Even worse - a CVE was not created for 3 days after it was discovered.

I'm sure many companies using it will never even know this breach has happened.

Another recent case was Axios, a popular data fetching library.

What can we do to mitigate the risk of these happening?

Do use vulnerability scanning tools. Even if Trivy was breached, it still scans all the other packages for CVEs and misconfigurations.

Pin package dependencies so you control when they are updated.…