A step-by-step checklist for verifying whether the compromised Nx Console VS Code extension exposed developer secrets, auditing installed extensions, and rotating any potentially affected cloud credentials.
A technical look at the first known AI-generated zero-day exploit, its detection in a mass cyberattack, and what it means for hardening JavaScript supply chains against automated offensive tooling.
A technical walkthrough of the TanStack npm supply-chain compromise, focusing on how the backdoored packages attempted to harvest CI/CD, GitHub, and cloud credentials and what npm consumers should check immediately.
A malicious PyPI release of PyTorch Lightning / lightning used import-time execution to download Bun and run an obfuscated payload that turned a trusted ML dependency into a credential stealer.
A malicious PyTorch Lightning 2.6.2/2.6.3 PyPI release highlights how AI and ML dependencies can execute import-time credential theft and expose developer, CI, and cloud secrets.
April 2026 showed that AI agents, SaaS integrations, and ordinary web and supply-chain risks now sit in the same AppSec threat model, with untrusted input, OAuth blast radius, and package compromise driving the month's most important security signals.
A practical incident-response and hardening guide for Node.js teams after the Axios npm compromise, focused on install-time execution, secret exposure, and safe remediation steps.
A practical guide to rotating exposed secrets and hardening access controls after a supply chain compromise, using the Vercel April 2026 incident as context.