The security team at the open source repository, NPM, have removed 17 malware infected Java Script libraries from their servers. This is important as many code developers depend on the trust of NPM to develop application that we all use, and if they use infected code, then that will be baked into their final product and their users will be vulnerable.
Malicious NPM packages are part of a malware “barrage” hitting repositories | Ars Technica
This has echoes of the SolarWinds compromise where the malicious code had been introduced during the production of a patch, so evading detection.
More
Another developer resources has come under attack. A ransomware attack is being reported at GitLab.
Confluence and GitLab servers targeted by new ransomware strain – The Record by Recorded Future
A similar attack is being reported at Confluence – a workforce collaboration tool.
Supply chain compromise:
SolarWinds hack explained: Everything you need to know (techtarget.com)
How Russia Used SolarWinds To Hack Microsoft, Intel, Pentagon, Other Networks : NPR
