Articles
Stay informed on security insights and best practices from Snyk’s leading experts.
表示中 1 - 20 / 374 記事
How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM
On March 24, 2026, threat actor known as TeamPCP published backdoored versions of the litellm Python package after stealing PyPI credentials via a compromised Trivy GitHub Action in LiteLLM's CI/CD pipeline. Here's what happened, how the three-stage malware works, and how to check if you're affected.
Trivy GitHub Actions Supply Chain Compromise
Attackers compromised 75 version tags of the popular Trivy GitHub Action, turning the security scanner into a credential-stealing tool. Learn how the two-stage attack chain unfolded, whether you're affected, and how to secure your CI/CD pipelines against GitHub Actions supply chain attacks.
Inside StegaBin: How a DPRK Steganography Campaign Generated Headlines
North Korean hackers published 26 malicious npm packages using Pastebin steganography for C2. It made headlines everywhere. We checked the data: zero real-world impact. Here's what the campaign actually did, and what it tells us about the real risk of malicious package campaigns.
Your AI "Skills" Are the New Agentic Attack Surface
As AI moves beyond simple chat to autonomous execution, the skills powering these agents have emerged as a dangerous new attack surface. Learn how to protect your organization from malicious AI agent tools while maintaining development velocity in the age of agentic workflows.
Anthropic Just Launched Claude Code Security. Here's Why That's Great News for the Industry
Anthropic's launch of Claude Code Security is sparking headlines about the end of traditional security, but the real story is about the shift from detection to automated remediation. This move validates a layered security approach that combines AI reasoning with deterministic analysis to protect the modern software supply chain.
Building Safer AI Agents with Structured Outputs
Learn how structured outputs help developers build safer, more reliable AI agents by enforcing strict schemas during token generation. Discover the essential frameworks and security tools needed to move your AI agents to an enforcement-based production environment.
Top 8 Claude Skills for Finance and Quantitative Developers
Quantitative finance is evolving as algorithmic traders shift from AI skepticism to practical automation using Claude Skills. Learn how to leverage the latest Claude Skills and security best practices to reclaim mental bandwidth for high-level financial judgment.
SAST vs. DAST vs. IAST vs. RASP: Understanding Application Security Testing Methods
Navigate the key differences between SAST, DAST, IAST, and RASP. This guide explains how to integrate these testing methods throughout the software development lifecycle to eliminate blind spots and block real-time attacks.
4 Reasons Why Dynamic Security Testing Is Critical For All Your Assets
Attackers don't just target your crown jewels; they look for the weakest link in your entire application footprint. Limiting dynamic security testing to tier-one apps leaves dangerous blind spots across forgotten APIs and internal tools. Discover why universal DAST is critical for modern risk management and how it helps teams uncover hidden vulnerabilities before they become entry points for a breach.