Endor Labs provides software supply chain security solutions.

Endor Labs

80% of code in modern applications is code your developers didn’t write, but “borrowed” from the internet. With over 3M Open Source Software (OSS) projects, 43M versions, and 3.1T downloads yearly, development teams can gain tremendous benefits from leveraging the OSS ecosystem, as long as organizations invest in the tooling to address the security, scalability and sustainability challenges that come with it. 

At Endor Labs, we've created the first open source dependency lifecycle management platform to help OSS consumers select, secure and maintain dependencies effectively.

Silicon Valley CISO Investments

Dell Technologies Capital

Preface Ventures

Lightspeed Venture Partners

Sierra Ventures

Aparna Bawa

David Tsao

James Governor

Jay Chaudhry

Nikesh Arora

Shanku Niyogi

Stacy Hong

Coatue

Section 32

LeanAppSec just launched a new course on 𝐒𝐁𝐎𝐌𝐬 𝐟𝐨𝐫 𝐀𝐩𝐩𝐒𝐞𝐜 𝐚𝐧𝐝 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞!

𝐂𝐡𝐞𝐜𝐤 𝐨𝐮𝐭 𝐭𝐡𝐞 𝐜𝐨𝐮𝐫𝐬𝐞 𝐢𝐟 𝐲𝐨𝐮:
💬 𝐖𝐚𝐧𝐭 𝐭𝐨 𝐫𝐞𝐬𝐩𝐨𝐧𝐝 𝐪𝐮𝐢𝐜𝐤𝐥𝐲 𝐭𝐨 𝐬𝐮𝐩𝐩𝐥𝐲 𝐜𝐡𝐚𝐢𝐧 𝐢𝐧𝐜𝐢𝐝𝐞𝐧𝐭𝐬: Use SBOMs to track where you have affected components
🏛️ 𝐂𝐚𝐫𝐞 𝐚𝐛𝐨𝐮𝐭 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞: Learn how you can generate and share SBOMs with auditors/regulators
🔧 𝐖𝐚𝐧𝐭 𝐭𝐨 𝐛𝐮𝐢𝐥𝐝 𝐚 𝐦𝐚𝐭𝐮𝐫𝐞 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐩𝐫𝐨𝐠𝐫𝐚𝐦: An SBOM shows your organization has a well-developed security practice.

https://lnkd.in/gQ_ukbkh

#SBOM #AppSec #Compliance

We are extremely proud to be named to Inc's Best Workplaces list for 2024. 

Our team’s commitment, innovation, and drive have helped us build an amazing product. But more importantly, it's their passion and love for what they do that earned us this recognition. 

Every win is a team effort, but this one truly stands out.
https://lnkd.in/gfqDv6Kc 

#Hiringnow #AppSec #IncBestWorkplaces

As my second born is right about to hit two months old, I am reflecting on how thankful I am to have this time with him and my family! I just hit one year at Endor Labs and am so grateful to celebrate this milestone while on maternity leave. 

Thanks to Endor Labs for the incredible support and generous time off, making it possible to balance a career and motherhood. It’s no wonder we were just named on Inc's Best Workplaces list for 2024! I’m truly proud to be part of such a supportive and amazing team! 🙏🏼🚀🏆 

(pic included:  family outing to the local zoo 🥰)

Check out highlights from the past year in this announcement:
https://lnkd.in/gQ6NjbWG 

#Hiringnow #AppSec #IncBestWorkplaces

Three #CocoaPods CVEs raise serious security concerns for consumers of Swift and Objective-C libraries used for macOS and iOS mobile development.

E.V.A Information Security discovered three vulnerabilities in the Trunk server that runs the whole CocoaPods repository, causing significant concern.

These vulnerabilities existed for a decade before they were discovered, making the CocoaPods supply chain fragile. If you’ve been using them for several years, there’s no telling when your Pods could have been sabotaged.

The good news is that these problems have been patched by CocoaPods prior to the disclosure.

The bad news is that no one really knows if adversaries took advantage of these vulnerabilities.

Here’s a quick rundown of CocoaPods and what you can do to ensure your dependencies are up-to-date:
https://lnkd.in/gz-PiCXH 

#CocoaPods #Swift #ObjectiveC

𝐖𝐡𝐲 𝐃𝐨𝐞𝐬 𝐈𝐭 𝐌𝐚𝐭𝐭𝐞𝐫 𝐖𝐡𝐞𝐭𝐡𝐞𝐫 𝐚 𝐃𝐞𝐩𝐞𝐧𝐝𝐞𝐧𝐜𝐲 𝐈𝐬 𝐓𝐫𝐚𝐧𝐬𝐢𝐭𝐢𝐯𝐞 𝐨𝐫 𝐃𝐢𝐫𝐞𝐜𝐭?

The relationship a dependency has to your first-party code matters because it changes how you assess and respond to risks. And since, statistically, most of the code that makes up your application — and therefore most of the vulnerabilities and other risks (95%, according to our research with Station 9) — are in these transitive dependencies, it’s important to understand the ways they’re a bit complex to deal with.

𝘛𝘩𝘦𝘳𝘦 𝘢𝘳𝘦 𝘵𝘩𝘳𝘦𝘦 𝘵𝘩𝘪𝘯𝘨𝘴 𝘵𝘩𝘢𝘵 𝘮𝘢𝘬𝘦 𝘥𝘦𝘢𝘭𝘪𝘯𝘨 𝘸𝘪𝘵𝘩 𝘵𝘳𝘢𝘯𝘴𝘪𝘵𝘪𝘷𝘦 𝘥𝘦𝘱𝘦𝘯𝘥𝘦𝘯𝘤𝘪𝘦𝘴 𝘢 𝘭𝘪𝘵𝘵𝘭𝘦 𝘸𝘦𝘪𝘳𝘥𝘦𝘳 𝘵𝘩𝘢𝘯 𝘥𝘦𝘢𝘭𝘪𝘯𝘨 𝘸𝘪𝘵𝘩 𝘥𝘪𝘳𝘦𝘤𝘵 𝘥𝘦𝘱𝘦𝘯𝘥𝘦𝘯𝘤𝘪𝘦𝘴:

1️⃣ You can have multiple different versions of the same transitive dependency in your application
2️⃣ It’s harder to see what parts of a transitive dependency are actually being used
3️⃣ It’s generally a bad idea to update transitive dependencies on your own

In or near LA? Come to tonight’s #OWASP local chapter meeting (5:30pm at HiveWatch HQ) for “What’s in your AI code?” and some free food!

Details and RSVP on Meetup (link in comments)

COM:ENDORLABS

Endor Labs

Filings Not Available