See how AI is collapsing the exploit window, turning patches into attacker intelligence, and forcing security teams to rethink software risk.

The package poses as a security tool targeting developers looking to integrate Internet-based apps with telecom networks using Twilio.

ExtraHop's Kanaiya Vasani unpacks the concept of the agentic SOC — and how the Agentic SOC Alliance is working to build them out.

ReversingLabs built a Spectra Analyze integration with CrowdStrike Falcon. The connector is available now as part of Spectra Analyze v9.6.0.

Aurastealer, ACRStealer, and RemusStealer, a new potential LumaStealer variant, show MaaS in action. Here's what you need to know.

YouTube video by ReversingLabs

Original RL research on ClickFix: the attack chain, the MaaS economy behind it, and the YARA detection strategy that catches what AV and EDR miss.

Explore the new Gartner® Magic Quadrant™ for software supply chain security and learn why ReversingLabs is recognized.

Explore the new Gartner® Magic Quadrant™ for software supply chain security and learn why ReversingLabs is recognized.

By disabling install scripts by default, it closes the vector worms like Shai-Hulud rely on. Here's what the update fixes — and what it doesn't.

RL has discovered two social engineering attack techniques targeting users via short-form videos. Here’s how they work.

48,000 CVEs were reported in 2025 — but just 58 were critical. A new report highlights why signal-to-noise ratio matters for AppSec.

RL has discovered a new supply chain attack affecting 9.8M total downloads across Red Hat's Hybrid Cloud Console JavaScript ecosystem.

Analyzing C2 responses from compromised GitHub Actions linked a current threat to an earlier one, showing the value of retrohunting.

RL researchers documented 163 samples tied to CVE-2026-31431, identified active malware adoption — and developed YARA rules to identify them.

Here are the facts on Mythos — and why your organization must adopt a layered security framework to match the new frontier models.

This class of AI tool supply chain attack highlights how trust of agents can be exploited by threat actors.

The malicious npm package has evolved into a dependency that allows attackers to access users’ crypto wallets and funds.

Sign up | ReversingLabs Spectra Assure Community

ReversingLabs built it to help development and AppSec teams secure open source dependencies, detect malware — and prevent supply chain attacks.

NK threat actors targeting crypto developers are back with an LLC and new techniques to hide malware. Here's RL's analysis.

NK threat actors targeting crypto developers are back with an LLC and new techniques to hide malware. Here's RL's analysis.

Here's an incident-response checklist and ongoing best practices. Plus: How RL’s xBOM and Spectra Assure Community can help.

JPMC CISO Patrick Opet discussed his open letter on third-party software risk — and the changes suppliers have made since.

Supply chain risk analysis for jjrawlins-cdk-iam-policy-builder-helper@0.0.194. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

Supply chain risk analysis for axios@1.14.1. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

Supply chain risk analysis for telnyx@4.87.2. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

The final-stage malware in the Ghost campaign is a RAT designed to steal crypto wallets and sensitive data.

Supply chain risk analysis for @teale.io/eslint-config@1.8.9. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

Package URLs give software components an exact address to improve vulnerability matching, which reduces alert fatigue and simplifies compliance.

AI coding is the new reality — and it will further destabilize software supply chain security. So step up your AppSec.

In this latest incident, threat actors target developers with a bogus package — a shift away from cryptocurrency development targets.

Learn how to leverage ReversingLabs’s dynamic analysis of <em>pkr_mtsi</em> for defense using YARA Rules in Spectra Analyze.