Tag
Cloudflare Gateway can now allow or block package downloads across seven ecosystems. Detection is fail-open, and an unparseable version string matches no comparison at all.
Manu Shukla 
Choosing a Node.js development company in 2026 is mostly a question about version support. Node.js 20 is unpatched, Node.js 24 leaves Active LTS in October, and the runtime's release model changes with version 27. Here
Manu Shukla 
On 4 August 2026 a worm published poisoned versions of keyv and cacheable carrying valid npm provenance. Rotating credentials first triggers a dead-man's switch. Nine controls for Node-heavy teams, and what npm v12 does
Manu Shukla 
Attackers force-pushed 75 of 76 trivy-action tags in March 2026 and stole secrets from every pipeline that ran a scan. Here is the credential isolation architecture that survives a poisoned action, with working YAML.
Manu Shukla 
Valid provenance signed keyv 6.0.0 on 4 August 2026, and eight malicious releases were still tagged latest 101 minutes later. What attestations prove, and the cooldown config for npm, pnpm, Yarn and Bun.
Manu Shukla 
Zafran Security's FaceHugger research showed three ways a crafted Hugging Face repo runs Python during from_pretrained even when trust_remote_code is False. Here is the patch path and the policy.
Manu Shukla 
A hijacked maintainer account pushed Shai-Hulud malware into the keyv and cacheable npm family on 4 August 2026, with valid GitHub Actions provenance. Here is the containment order for the first 90 minutes.
Manu Shukla 
On 28 July 2026 GitHub began ingesting OpenSSF malicious-packages advisories, so Dependabot malware alerts now cover npm, PyPI and more. Here is how to enable them and respond when one fires.
Manu Shukla 
The Node.js permission model gained --allow-net in v25 (October 2025). This guide shows how to scope file, network and process access in production, using the 2026 npm supply-chain attacks as motivation.
Manu Shukla 
TanStack's release pipeline authenticated 84 malicious npm versions in six minutes using a valid OIDC token. No token was stolen. Here is the chain, and the controls that close it as of November 2026.
Manu Shukla 
Adversa AI tested 11 open-source coding agents in June 2026 and beat the safety filter on 10 of them with shell tricks that are 30 years old. How the bypass works, which designs held, what to change now.
Manu Shukla 
Eleven CVEs landed against Model Context Protocol implementations in April 2026, and Anthropic called the underlying STDIO behaviour expected. Here is what that means for anyone running MCP servers in production
Manu Shukla 
npm 12 is generally available and tagged latest. Lifecycle scripts, git dependencies and remote tarballs are now opt-in, node-gyp builds are blocked, and the failure shows up in CI first. Here is the migration.
Manu Shukla 