Dave Ferguson @_sc0rn

Product Manager in Software Supply Chain Security. 20-year AppSec pro. Constant & curious learner. Former engineer/developer/consultant/pen tester/SA. Texas, USA Joined October 2013

Tweets

2K
Followers

608
Following

670
Likes

3K

Dave Ferguson @_sc0rn

4 days ago

Fintech company NuPay blames a ‘configuration gap’. That's certainly one way to describe an s3 bucket left wide open. finance.yahoo.com/news/thousands…

0 0 0 63 0

Dave Ferguson @_sc0rn

2 weeks ago

A first of its kind self-replicating worm that compromises npm packages with token-stealing malware. thehackernews.com/2025/09/40-npm…

0 0 0 50 0

❗️New packages are appearing in this ongoing campaign. Among the compromised is the ng2-file-upload (secure.software/npm/packages/n…) package that has 100k weekly downloads and more than 19Milion total downloads.

1 1 0 629 0

Dave Ferguson @_sc0rn

2 months ago

The rise of AI slop could mean the end of bug bounties. infosec.exchange/@harrysintonen…

0 0 0 27 0

Dave Ferguson @_sc0rn

2 months ago

"Now it was clear: Hackers were breaking into SharePoint all over the world." wsj.com/tech/cybersecu…

0 0 1 47 0

Dave Ferguson @_sc0rn

2 months ago

Another OSS-based software supply chain attack. bleepingcomputer.com/news/security/…

0 0 0 28 0

Dave Ferguson @_sc0rn

3 months ago

The packaging guidance for #Python wheel files was recently updated and now defines a directory where maintainers can include an #SBOM for the package. packaging.python.org/en/latest/spec…

0 0 0 28 0

ReversingLabs @ReversingLabs

3 months ago

⚠️🧵 RL researches have detected a supply chain attack in a #VSCode extension that has nearly 6000 installs: secure.software/vscode/package…

1 6 8 2K 2

Dave Ferguson @_sc0rn

4 months ago

Replies are the best part.

Luca @jdluk87

4 months ago

Replies are the best part.

2K 267 11K 11.2M 2K

0 0 0 51 0

Dave Ferguson @_sc0rn

4 months ago

My new blog is out, covering SaasBOMs and how they are useful to developers, infosec pros, and TPCRM teams. reversinglabs.com/blog/introduci…

0 0 0 22 0

ReversingLabs @ReversingLabs

5 months ago

⚠️🧵RL researchers detected a new malicious #PyPI package: solana-token. While pretending to be a #Solana related utility, it's actually capable of exfiltrating source code from developers’ machines. reversinglabs.com/blog/same-name… #CryptoAttacks #OpenSource

2 3 6 389 1

Dave Ferguson @_sc0rn

5 months ago

Having a CBOM - Cryptography Bill of Materials - for all of your software is a great place to start in the journey toward quantum readiness. globenewswire.com/news-release/2…

0 0 0 32 0

ReversingLabs @ReversingLabs

5 months ago

@owasp's #CycloneDX 1.6 calls for the ML-BOM, SaaSBOM, & CBOM - making them non-negotiable visibility requirements that go beyond the #SBOM. bit.ly/4jNCiTU

0 1 1 81 0

Kadi (Grigg) McKean @KadiGrigg

5 months ago

🎉 Milestone Unlocked! We just dropped the official @ReversingLabs Community Docs — your guide to all things Spectra Assure! 🛡️ Build safer software ⚙️ Contribute like a pro 🤝 Join our OSS fam Dive in 👉 docs.secure.software/community/ #OpenSource #DevSecOps #SupplyChainSecurity

1 3 3 234 0

Dave Ferguson @_sc0rn

5 months ago

Sad to see Firefox's market share shrink over the years. Still my favorite web browser by far, public.flourish.studio/visualisation/…

0 0 0 17 0

Dave Ferguson @_sc0rn

5 months ago

Why doesn't Apple offer disappearing messages for iMessage like every other messaging app? blog.cryptographyengineering.com/2025/03/01/dea…

0 0 0 18 0

Dave Ferguson @_sc0rn

6 months ago

An AI app that finishes transactions for you on all kinds of shopping sites without any human help? In 2018? Gullible investors. regtechtimes.com/sanigers-bold-…