Wednesday, April 30, 2025
HomeCyber Security NewsLinux Foundation Releases List of Most commonly used open-source Software & Security...

Linux Foundation Releases List of Most commonly used open-source Software & Security Problems

Published on

SIEM as a Service

Follow Us on Google News

Linux Foundation and Harvard’s Lab identifies the most commonly used free and open-source software and the potential vulnerabilities associated.

The Census II report determines the “important steps towards understanding and addressing structural and security complexities in the modern-day supply chain where open source is pervasive, but not always understood.”

The report also identifies the commonly used application in production environments and examine them for potential vulnerabilities.

- Advertisement - Google News

“The Census II report addresses some of the most important questions facing us as we try to understand the complexity and interdependence among open-source software packages and components in the global supply chain,” said Jim Zemlin, executive director at the Linux Foundation.

Starting from Heartbleed security bug, the importance of FOSS is understood than ever before and they are a critical part of a production environment, throughout the supply chain.

Most-Used Packages

  1. Async: A utility module that provides straight-forward, powerful functions for working with asynchronous JavaScript. Although originally designed for use with Node.js and installable via npm install async, it can also be used directly in the browser.
  2. Inherits: A browser-friendly inheritance fully compatible with standard node.js inherits.
  3. Isarray: Array#isArray for older browsers and deprecated Node.js versions.
  4. Kind-of: Get the native JavaScript type of value.
  5. Lodash: A modern JavaScript utility library delivering modularity, performance & extras.
  6. Minimist: Parse argument options. This module is the guts of optimist’s argument parser without all the fanciful decoration.
  7. Natives: Do stuff with Node.js’s native JavaScript modules.
  8. Qs: A querystring parsing and stringifying library with some added security.
  9. Readable-stream: Node.js core streams for userland.
  10. String_decoder: Node-core string_decoder for userland.

Most-Used Non-JavaScript Packages

  • com.fasterxml.jackson.core:jackson-core: A core part of Jackson that defines Streaming API as well as basic shared abstractions.
  • com.fasterxml.jackson.core:jackson-databind: General data-binding package for Jackson (2.x): works on streaming API (core) implementation(s).
  • com.google.guava:guava: Google core libraries for Java.
  • commons-codec: Apache Commons Codec software provides implementations of common encoders and decoders such as Base64, Hex, Phonetic and URLs
  • commons-io: Commons IO is a library of utilities to assist with developing IO functionality.
  • httpcomponents-client: The Apache HttpComponents™ project is responsible for creating and maintaining a toolset of low level Java components focused on HTTP and associated protocols.
  • httpcomponents-core: The Apache HttpComponents™ project is responsible for creating and maintaining a toolset of low level Java components focused on HTTP and associated protocols.
  • logback-core: The reliable, generic, fast and flexible logging framework for Java.
  • org.apache.commons:commons-lang3: A package of Java utility classes for the classes that are in java.lang’s hierarchy, or are considered to be so standard as to justify existence in java.lang.
  • Slf4j:slf4j: Simple Logging Facade for Java.

With FOSS constituting 80-90 percent of all software, it is more important than ever that we understand what FOSS is most used and where it could be vulnerable to attack, reads the report.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

AWS Defaults Open Stealthy Attack Paths Enabling Privilege Escalation and Account Compromise

A recent investigation by security researchers has exposed critical vulnerabilities in the default IAM...

China-Linked Hackers Targeting Organizational Infrastructure and High-Value Clients

A leading U.S.-based cybersecurity firm, sophisticated cyber-espionage campaigns attributed to Chinese state-sponsored actors have...

Docker Registry Vulnerability Lets macOS Users Access Any Registry Without Authorization

A recently discovered vulnerability in Docker Desktop for macOS is raising concerns in the developer and...

PowerDNS DNSdist Vulnerability Let Attackers Trigger Denial-of-Service

PowerDNS has issued an urgent security advisory for its DNSdist software, warning users of...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

AWS Defaults Open Stealthy Attack Paths Enabling Privilege Escalation and Account Compromise

A recent investigation by security researchers has exposed critical vulnerabilities in the default IAM...

China-Linked Hackers Targeting Organizational Infrastructure and High-Value Clients

A leading U.S.-based cybersecurity firm, sophisticated cyber-espionage campaigns attributed to Chinese state-sponsored actors have...

Docker Registry Vulnerability Lets macOS Users Access Any Registry Without Authorization

A recently discovered vulnerability in Docker Desktop for macOS is raising concerns in the developer and...