Library security covers flaws in shared code components, dependency risks, and patching practices that can expose applications and their users.
Search across headline titles and summaries.
Background for this topic.
A library is a packaged collection of reusable code that an application incorporates rather than implementing itself. Libraries may be maintained internally, obtained from public repositories, or included indirectly through other dependencies. Their security properties therefore become part of the application’s attack surface, often without developers reviewing every function.
Security concerns include vulnerabilities in library code, unsafe defaults, malicious or tampered packages, and abandoned versions that no longer receive fixes. A vulnerable dependency may be exploitable only under specific conditions, so risk assessment should consider the affected code path and exposure rather than version numbers alone. Useful controls include pinning and reviewing dependency versions, verifying package provenance and integrity, tracking direct and transitive dependencies in an inventory such as an SBOM, scanning for known vulnerabilities, and testing updates before deployment. When a flaw is disclosed, maintainers need a process to identify affected applications, apply a compatible update or mitigation, and remove unsupported libraries.
Weekly headline count for the current query.
A tokenizer library file present in Hugging Face AI models can be manipulated to hijack the model's outputs and exfiltrate data.
The NPM package for Axios, a popular JavaScript HTTP client library, was briefly compromised this week, possibly by North Korean threat actors.
TeamPCP is the likely cyber threat actor behind attacks on Trivy, Checkmarx's KICS and VS Code plug-ins, and the LiteLLM AI library — and all signs point to more attacks to come.
A maximum-severity vulnerability affecting the React JavaScript library is under attack by Chinese-nexus actors, further stressing the need to patch now.
Chainguard provides DevSecOps teams with a library of "secure-by-default" container images so that they don't have to worry about software supply chain vulnerabilities. The startup is expanding its focus to include Java and Linux, as well.
Researchers found the threat actor attempting to use the now-patched flaw to load and execute a malicious dynamic link library on infected systems.
Researchers testing generative AI systems can use prompt injection, re-register after being banned, and bypass rate limits without running afoul of copyright law.
Outlook, Teams, PowerPoint, OneNote, Excel, and Word undermine macOS's strict user permission-based privacy and security protections.
The novel malware targets Spanish-speaking users via malicious Google Drive links, and taps a popular C++ library to evade detection.
Knowledge institutions with legacy infrastructure, limited resources, and digitized intellectual property must protect themselves from sophisticated and destructive cyberattacks.
Librarians are being asked to defend themselves online against sophisticated and complex attacks. It’s an unequal fight.
The library said that it expects many of its services to be restored in the forthcoming weeks.
While Microsoft patched the issues in June, support for SketchUp appears to remain disabled in Microsoft 365.
The newly launched AI & ML Security Library allows developers to analyze the code used in machine learning systems to identify and address risks.
An overlooked library contains a vulnerability that could enable full remote takeover simply by clicking a link.
The maintainers of the widely used library recently patched multiple memory corruption vulnerabilities that attackers could have abused to, ahem, curse targets with malicious code and escalate privileges.
Turkorat-poisoned packages sat in the npm development library for months, researchers say.
Malware that can steal data, track location, and perform click fraud was inadvertently built into apps via an infected third-party library, highlighting supply chain risk.
The good news: The Apache Commons Text library bug is far less likely to lead to exploitation than last year's Log4j library flaw.
Branded as a components library for two popular open source resources, Material Tailwind instead loads a Windows .exe that can run PowerShell scripts.