Sonatype’s open-source eMudhra Audit and Fix script checks selected developer tools and certificate trust stores on Unix-like machines. The article explains remediation steps and warns that the script does not cover remote hosts, containers, or every installation.
Sonatype tests found that Java rejected listed eMudhra intermediate certificate encodings but accepted re-encoded versions with different SHA-256 fingerprints in the tested JDK and trust-store configurations.
A researcher reported that weak randomness made eight eMudhra intermediate CA private keys recoverable, potentially enabling trusted TLS certificates. Sonatype is updating affected products and urges customers to update trust stores and follow vendor guidance.
PHP says three vulnerabilities can enable unauthenticated RCE under affected conditions. It provides fixed releases for two PHP2Shell flaws and recommends temporarily disabling session upload progress for the follow-on issue while organizations inventory and patch PHP.
Sonatype says Nexus Repository Pro+ and Enterprise can block known malicious packages before they reach developers and builds. The article also recommends tracking dependency-related failures, late fixes and remediation time across comparable releases.
The article argues AI-generated development can amplify unsafe or unnecessary dependency choices, citing Sonatype and external research, and recommends live supply-chain intelligence, automated policy guardrails, and tracking remediation costs.
Sonatype says Nexus Repository Pro+ and Enterprise can screen requested components against its threat intelligence and organizational policies, blocking those identified as malicious, vulnerable, or out of policy before they reach downstream users.
Analysis of [email protected] found an install hook that could collect credentials, run remote JavaScript, publish data via a public GitHub repository, and modify accessible repos. Publication, downstream impact and broad CI infection remain unconfirmed.
Sonatype counted 149,329 malicious open-source packages in Q3 2026. Its index highlights droppers and secrets theft, including Mini Shai-Hulud's credential-enabled package propagation, and urges defenders to investigate impacts beyond dependency cleanup.
Sonatype outlines six controls for open-source dependencies, from approving sources and evaluating packages before download to monitoring changes in risk and providing clear remediation paths.
