Dave Ferguson @_sc0rn

Product Manager in Software Supply Chain Security. 20-year AppSec pro. Constant & curious learner. Former engineer/developer/consultant/pen tester/SA. Texas, USA Joined October 2013

Tweets

2K
Followers

612
Following

664
Likes

2K

Dave Ferguson @_sc0rn

a month ago

The rise of AI slop could mean the end of bug bounties. infosec.exchange/@harrysintonen…

0 0 0 17 0

Dave Ferguson @_sc0rn

a month ago

"Now it was clear: Hackers were breaking into SharePoint all over the world." wsj.com/tech/cybersecu…

0 0 0 37 0

Dave Ferguson @_sc0rn

2 months ago

Another OSS-based software supply chain attack. bleepingcomputer.com/news/security/…

0 0 0 25 0

Dave Ferguson @_sc0rn

2 months ago

The packaging guidance for #Python wheel files was recently updated and now defines a directory where maintainers can include an #SBOM for the package. packaging.python.org/en/latest/spec…

0 0 0 27 0

ReversingLabs @ReversingLabs

3 months ago

⚠️🧵 RL researches have detected a supply chain attack in a #VSCode extension that has nearly 6000 installs: secure.software/vscode/package…

1 6 8 2K 2

Luca @jdluk87

3 months ago

Replies are the best part.

2K 269 11K 11.2M 2K

0 0 0 50 0

Dave Ferguson @_sc0rn

4 months ago

My new blog is out, covering SaasBOMs and how they are useful to developers, infosec pros, and TPCRM teams. reversinglabs.com/blog/introduci…

0 0 0 22 0

⚠️🧵RL researchers detected a new malicious #PyPI package: solana-token. While pretending to be a #Solana related utility, it's actually capable of exfiltrating source code from developers’ machines. reversinglabs.com/blog/same-name… #CryptoAttacks #OpenSource

2 3 7 389 1

Dave Ferguson @_sc0rn

4 months ago

Having a CBOM - Cryptography Bill of Materials - for all of your software is a great place to start in the journey toward quantum readiness. globenewswire.com/news-release/2…

0 0 0 32 0

ReversingLabs @ReversingLabs

4 months ago

@owasp's #CycloneDX 1.6 calls for the ML-BOM, SaaSBOM, & CBOM - making them non-negotiable visibility requirements that go beyond the #SBOM. bit.ly/4jNCiTU

0 1 1 80 0

Kadi (Grigg) McKean @KadiGrigg

4 months ago

🎉 Milestone Unlocked! We just dropped the official @ReversingLabs Community Docs — your guide to all things Spectra Assure! 🛡️ Build safer software ⚙️ Contribute like a pro 🤝 Join our OSS fam Dive in 👉 docs.secure.software/community/ #OpenSource #DevSecOps #SupplyChainSecurity

1 3 3 234 0

Dave Ferguson @_sc0rn

5 months ago

Sad to see Firefox's market share shrink over the years. Still my favorite web browser by far, public.flourish.studio/visualisation/…

0 0 0 17 0

Dave Ferguson @_sc0rn

5 months ago

Why doesn't Apple offer disappearing messages for iMessage like every other messaging app? blog.cryptographyengineering.com/2025/03/01/dea…

0 0 0 18 0

Dave Ferguson @_sc0rn

5 months ago

An AI app that finishes transactions for you on all kinds of shopping sites without any human help? In 2018? Gullible investors. regtechtimes.com/sanigers-bold-…

0 0 0 12 0

ReversingLabs @ReversingLabs

5 months ago

⚠️🧵 RL researchers have discovered 11 #VSCode extensions & 10 #npm packages that are a part of a new, malicious campaign.

1 2 7 834 0

Dave Ferguson @_sc0rn

5 months ago

UPDATE: ethers-provider2 has been removed from the npm registry. You can still see the SAFE assessment for it at secure.software/npm/packages/e…

Dave Ferguson @_sc0rn

5 months ago

UPDATE: ethers-provider2 has been removed from the npm registry. You can still see the SAFE assessment for it at secure.software/npm/packages/e…

0 1 2 320 0

0 0 0 27 0

Dave Ferguson @_sc0rn

5 months ago

Wow. The malicious package ether-provider2 is still available from the npm registry. But RL's Spectra Assure has it labeled as malicous. secure.software/npm/packages/e…

ReversingLabs @ReversingLabs

5 months ago

Wow. The malicious package ether-provider2 is still available from the npm registry. But RL's Spectra Assure has it labeled as malicous. secure.software/npm/packages/e…