Tamir Ben Ari

Tamir Ben Ari is a malware researcher at Mend.io specializing in software supply chain. Previously, he held the role of security researcher at Mend.io, which included detailed vulnerability research in open source libraries.

The Unseen Risks of Open Source Dependencies: The Case of an Abandoned Name

Tamir Ben Ari, Tom Abai 31 May 2023

Dependency Updates

Mend.io research discovered a threat actor takeover of the name ‘gemnasium-gitlab-service’, a retired Ruby gem with two million+ downloads.

Yandex Data Leak Triggers Malicious Package Publication

Tamir Ben Ari 30 Jan 2023

Malicious Packages

Discover how the Yandex data leak triggered malicious package publication, leading to supply chain security risks.

Malicious Code Deletes Directories If You Do Not Have a License

Tamir Ben Ari 10 Jan 2023

Malicious Packages

Discover how malicious code can delete directories if you don’t have a license. Learn about supply chain security and license compliance.

Today’s Security Tidbit: An Encrypted JSON File Containing Malicious Code

Tamir Ben Ari 2 Aug 2022

Malicious Packages

Discover how encrypted JSON files are being used to hide malicious code. Learn about the latest security findings and how to protect your apps.

Single Author Uploaded 168 Packages to npm as Part of a Massive Dependency Confusion Attack

Tamir Ben Ari 20 Jun 2022

Open Source Security

Discover how a single author uploaded 168 malicious npm packages in a dependency confusion attack. Learn how Mend blocked these threats.

New Typosquatting Attack on npm Package ’colors’ Using Cross language Technique Explained

Maria Korlotian, Tamir Ben Ari 12 May 2022

Malicious Packages

Discover the latest typosquatting attack on the npm package ‘colors’ using a cross-language technique.

AWS Targeted by a Package Backfill Attack

Tamir Ben Ari 1 May 2022

Application Security

Discover how AWS was targeted by a malicious package backfill attack, the methods used by attackers, and how to protect against such attacks.

Automated Software Supply Chain Attacks: Should You be Worried?

Tamir Ben Ari 1 Apr 2022

Software Supply Chain

Learn why automated software supply chain attacks are a growing threat. Discover how to protecting your org from malicious NPM packages.

MEND PLATFORM

Expand AppSec Coverage

Featured

From Reactive to Effective: Building Application Security that Works

Enhance Supply Chain Security with Proactive SBOM Management

Tamir Ben Ari

The Unseen Risks of Open Source Dependencies: The Case of an Abandoned Name

Yandex Data Leak Triggers Malicious Package Publication

Malicious Code Deletes Directories If You Do Not Have a License

Today’s Security Tidbit: An Encrypted JSON File Containing Malicious Code

Single Author Uploaded 168 Packages to npm as Part of a Massive Dependency Confusion Attack

New Typosquatting Attack on npm Package ’colors’ Using Cross language Technique Explained

AWS Targeted by a Package Backfill Attack

Automated Software Supply Chain Attacks: Should You be Worried?

Subscribe to our Newsletter

Products

Solutions

Company

Resources

Connect

Developer Tools