A hands-on audit of GitHub-to-PyPI publishing paths, tracing how LiteLLM's long-exposed GitHub master key enabled a package compromise and what controls — secret scanning, token revocation, trusted publishing, pinning, and attestations — actually close the gap.
An audit-focused guide to hardening GitHub release workflows after attackers hijacked five OVHcloud CLI releases to distribute secret-stealing malware.
A hands-on test of whether npm provenance attestations and --ignore-scripts actually block an install-time RAT payload, using the Overlord RAT npm packages that racked up 40,767 downloads as the reference case.
A newly disclosed GitHub Copilot CLI vulnerability abuses encrypted prompt injection to exfiltrate developer secrets and local files, while a ransomware affiliate separately weaponizes AI coding assistants and MCP servers as command-and-control channels in live enterprise intrusions.
GlassWorm's fake VS Code theme extensions show why Workspace Trust alone cannot prevent malicious IDE extensions from compromising developer environments.
Provenance attestations prove where an npm package was built, not who was at the keyboard when it was published, which is why a hijacked maintainer account can still push credential-stealing releases through a fully verified pipeline.
A technical anatomy of the first self-propagating supply-chain worm to target AI agent memory infrastructure through malicious npm and PyPI packages, explaining how it spreads and what defensive controls matter.
A practical walkthrough of lifecycle-script diffing and provenance verification for npm releases, showing how to detect and contain the kind of repository-to-registry backdoor chain that hit 65 GitHub repos.
A hands-on test of Homebrew 7.0.0's built-in vulnerability scanner and package sandboxing using a deliberately vulnerable tap, benchmarked against osv-scanner and Socket.
A technical walkthrough of the malicious Axios npm release shows exactly how a postinstall hook escalates from a dependency install into remote code execution inside CI pipelines, and which lockfile and install-script signals developers should audit first.
An analysis of how long-lived package registry tokens become a supply-chain liability once autonomous agents can publish packages at scale, using the RubyGems incident to show why scoped credentials, provenance, and publish controls are now essential.
A practical analysis of the JFrog Artifactory authentication bypass being exploited for admin access, with a focus on how CI/CD compromise expands the real blast radius for developers and platform teams.
A developer-focused look at how 91 Spring CVEs affect more than 209,000 software components and how to identify the most exploitable paths before rushing to patch everything.
A practical analysis of how malicious npm packages can deploy the RedC2 Linux implant in CI pipelines and how npm security checks can help detect and block it.
This post examines code-level indicators that can help developers spot MessiahGPT-generated malicious JavaScript embedded in package supply chains and respond before it reaches production.
This post examines how npm dependency takeovers can bypass trust signals like maintainer reputation and commit signing, and what developers should audit instead.
A practical developer-focused look at the AsyncAPI npm supply-chain compromise, outlining what happened and the concrete steps teams can take to harden dependency management and reduce package risk.
Miasma’s latest npm payload shifts from worm behavior to a RAT-first approach with automatic propagation disabled, signaling a stealthier supply-chain threat for developers and package maintainers.
Learn how to audit your npm pipeline after the jscrambler compromise by checking dependency integrity, install scripts, and developer exposure across your build process.
An analysis of the Jscrambler npm package compromise that explains what npm integrity checks and code signing can miss, and how developers should verify package trust in the supply chain.
An analysis of OpenClaw’s skill marketplace reveals how agentic AI platforms can amplify supply chain risks through third-party skills, prompting concrete defensive controls for developers and security teams.
A developer-focused analysis of how the Bajaj Auto breach underscores the need to harden JavaScript APIs and dependencies against supply chain attacks.
This post examines the TanStack npm supply chain compromise confirmed by Grafana, focusing on how malicious postinstall scripts stole GitHub tokens and enabled repository cloning, plus the practical defenses developers should apply.
GitHub’s updated actions/checkout release blocks common pwn request attack patterns, and JavaScript developers need to understand what changed to keep CI pipelines and pull request workflows secure.