We uncover a critical security flaw in tar-fs, a widely used Node.js package, and show how it could lead to remote code execution. Learn how the bug was missed, how it works, and what we did to fix it.

On March 31, 2025, the Payment Card Industry Data Security Standard (PCI DSS) will evolve to address the growing complexity of cybersecurity threats, introducing significant updates to vulnerability management requirements. Learn how to stay compliant.

npm’s overrides feature was meant to give developers control over transitive dependencies but instead introduced inconsistencies—sometimes reverting to vulnerable versions. Seal Security identified the issue in 2023, but it took nearly two years and community effort to get a fix merged. Now, with npm 11.2.0, overrides finally works as intended.

Seal Security is excited to announce it’ll join Snyk’s Technology Alliance Partner Program, to provide a seamless integration and product experience for Snyk customers who want to streamline their open source vulnerability patching efforts using Seal’s solution.

Seal OS, the first holistic solution designed to automatically fix vulnerabilities in both Linux operating systems and application code.

Legacy applications remain a persistent reality in production environments, and cybersecurity teams must confront the challenges they pose. Seal Security offers a solution to help businesses easily and effectively mitigate vulnerabilities and protect critical assets.

Open source libraries often depend on specific versions of other libraries, and those dependencies might have changed over time. When a library was built years ago, the environment it depended on no longer exists in its original form. Package managers like npm are designed to handle these kinds of issues by allowing version ranges for dependencies. So, how do we ensure we have the exact versions of every dependency when trying to fix old libraries?

Traditional open source vulnerability remediation is a significant bottleneck in modern security. Organizations often grapple with hundreds or thousands of high and critical vulnerabilities, yet the process of upgrading dependencies is a manual, time-consuming, and error-prone task, heavily reliant on developers.

Organizations are increasingly relying on open source software (OSS) to accelerate development and innovation. However, with great power comes great responsibility – and in this case, significant security risks. Enter the curated OSS catalog, a solution that ensures secure-by-default OSS usage. Let’s explore what a curated OSS catalog are and who stands to benefit from them.

This blog post explores the complexities of dependency management, unveiling why the constant update treadmill might not be the most efficient approach. We'll delve into the challenges developers face and propose alternative strategies for a more balanced and secure open source ecosystem.