Security Research

Lessons from the AsyncAPI npm Compromise: Why Proactive Runtime Enforcement Matters

Lessons from the AsyncAPI npm compromise and why proactive runtime enforcement is key to stopping software supply chain threats.

Lessons from the @mastra Supply Chain Attack

The @mastra attack shows why blocking malicious execution and minimizing entitlements are both critical

Inside the Mini Shai-Hulud Campaign: Anatomy of a Cross-Ecosystem Supply Chain Attack

Mini Shai-Hulud shows how supply chain attacks now target CI/CD, cloud identities, and multiple ecosystems at runtime.

Shai-Hulud 2.0: Escalating npm Supply-Chain Threat Demands Immediate Attention Copy

The npm ecosystem is once again at the center of a major supply-chain security incident.

Shai-Hulud 3.0: When a Supply-Chain Worm Evolves - and Makes Mistakes

What changed in Shai-Hulud 3.0, what went wrong for the attacker, and how Sweet Security can detect and stop this threat in real time.

Shai-Hulud 2.0: A Deeply Automated npm Supply-Chain Worm

The npm ecosystem is once again at the center of a major supply-chain security incident.

Largest npm Supply-Chain Attack to Date Targets Billions of Downloads

The npm ecosystem has suffered an unprecedented supply-chain attack.

ECScape: Understanding IAM Privilege Boundaries in Amazon ECS

Part 2 of our educational series on Amazon ECS security

Under the Hood of Amazon ECS on EC2: Agents, IAM Roles, and Task Isolation

When running containers on Amazon ECS using EC2 instances, there’s a lot happening under the hood on each host.

Hijacking Privileges in the Cloud: Breaking Role Boundaries in Amazon ECS

Hijacking Privileges in the Cloud: Breaking Role Boundaries in Amazon ECS

Understanding Elastic Index Mappings and Field Limits

Mappings help Elasticsearch store and search data efficiently.

Python Tar-File Vulnerability (CVE-2024-12718): What You Need to Know

A critical vulnerability in Python's tarfile module (versions ≥ 3.12) allows attackers to modify metadata or permissions on files.

CVSS 10.0: Unauthenticated RCE - One Malformed SSH Handshake is All it Takes

On April 16, 2025, CVE-2025-32433 was disclosed—a critical remote code execution (RCE) vulnerability.

NextJS Authorization Bypass (CVE-2025-29927) Highlights the Need for Stronger Runtime Security

Two researchers have recently discovered an authorization-bypass bug in the popular NextJS framework by Vercel. Tracked as CVE-2025-29927

IngressNightmare: How Runtime Changes the Game for Ingress-NGINX Kubernetes-Critical Vulnerabilities

A new set of high-severity vulnerabilities, collectively dubbed IngressNightmare, has been discovered by Wiz. Sweet keeps you secure.

CVE-2025-30066: tj-actions Supply Chain Attack

On Friday, a supply chain attack compromised the widely used GitHub Action tj-actions/changed-files, exposing secrets from numerous repos.

Of XZ and Unknown Unknowns

The recent XZ (liblzma) supply-chain attack is a marvel of social engineering and a great example of evading detection under the many-eyes..

From a Snowflake to a Snowball: How to Detect and Stop Impersonation Attacks

As reported, Snowflake, the data cloud company, is currently under fire for an account hacks campaign...

Responding to the CVE-2024-6387 (RegreSSHion) Vulnerability

Qualys research has discovered a critical Remote Code Execution (RCE) vulnerability, CVE-2024-6387, that has resurfaced in OpenSSH.

Defending Against the Latest Ghostscript Vulnerability (CVE-2024-29510)

Bleeping Computer has recently reported on a new vulnerability within Ghostscipt, a widely used library for handling PostScript and PDF file

Sweet Security Explains the '19 Capital One SSRF Breach

Welcome to CandyStore: Sweet Security’s Open Source Key-Value Storage

We’re excited to announce that Sweet Security has officially released CandyStore – an extremely fast open source key-value store