13 articles tagged
Cloudflare Gateway can now allow or block package downloads across seven ecosystems. Detection is fail-open, and an unparseable version string matches no comparison at all.
Choosing a Node.js development company in 2026 is mostly a question about version support. Node.js 20 is unpatched, Node.js 24 leaves Active LTS in October, and the runtime's release model changes with version 27. Here
On 4 August 2026 a worm published poisoned versions of keyv and cacheable carrying valid npm provenance. Rotating credentials first triggers a dead-man's switch. Nine controls for Node-heavy teams, and what npm v12 does
Attackers force-pushed 75 of 76 trivy-action tags in March 2026 and stole secrets from every pipeline that ran a scan. Here is the credential isolation architecture that survives a poisoned action, with the exact GitHub
Valid provenance signed keyv 6.0.0 on 4 August 2026, and eight malicious releases were still tagged latest 101 minutes later. What attestations prove, and the cooldown config for npm, pnpm, Yarn and Bun.
Zafran Security's FaceHugger research showed three ways a crafted Hugging Face repo runs Python during from_pretrained even when trust_remote_code is False. Here is the patch path and the policy.
A hijacked maintainer account pushed Shai-Hulud malware into the keyv and cacheable npm family on 4 August 2026, with valid GitHub Actions provenance. Here is the containment order for the first 90 minutes.
On 28 July 2026 GitHub began ingesting OpenSSF malicious-packages advisories, so Dependabot malware alerts now cover npm, PyPI and more. Here is how to enable them and respond when one fires.
The Node.js permission model gained --allow-net in v25 (October 2025). This guide shows how to scope file, network and process access in production, using the 2026 npm supply-chain attacks as motivation.
TanStack's release pipeline authenticated 84 malicious npm versions in six minutes using a valid OIDC token. No token was stolen. Here is the chain, and the controls that close it as of July 2026.
Adversa AI tested 11 open-source coding agents in June 2026 and beat the safety filter on 10 of them with shell tricks that are 30 years old. How the bypass works, which designs held, what to change now.
Eleven CVEs landed against Model Context Protocol implementations in April 2026, and Anthropic called the underlying STDIO behaviour expected. Here is what that means for anyone running MCP servers in production
npm 12 is generally available and tagged latest. Lifecycle scripts, git dependencies and remote tarballs are now opt-in, node-gyp builds are blocked, and the failure shows up in CI first. Here is the migration.
