Small Bytes

How to Block Malicious PyPI Packages Before Installation with pip, uv, and Poetry

6 Oct 2026 - 3 min read - Alex Wichmann

A developer runs pip install. Another team uses uv sync. A third uses Poetry. They all pull Python dependencies, but a security rule configured in one client does not automatically apply to the others. If you want to stop a disallowed package

The Weekly Dependency Threat Report: 2026-10-03

5 Oct 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. whalibmob (npm) * Package: https://www.npmjs.com/package/whalibmob * Severity: critical * Affected versions: 5.33.5 * Downloads: 4681 * First seen: 30 September 2026 at

5 Hidden Risks in Your package.json File

29 Sep 2026 - 4 min read - Alex Wichmann

A package.json file is easy to skim. You see the packages your team added, maybe a few scripts, and a version number beside each dependency. It feels like a reasonable picture of what your application installs. It is only the starting

The Weekly Dependency Threat Report: 2026-09-26

28 Sep 2026 - 4 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. rrs (pypi) * Package: https://pypi.org/project/rrs/ * Severity: high * Affected versions: all * Downloads: 2282 * First seen: 21 September 2026 at 04:23 UTC

The Weekly Dependency Threat Report: 2026-09-19

20 Sep 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. noblox-asset.js (npm) * Package: https://www.npmjs.com/package/noblox-asset.js * Severity: critical * Affected versions: all * Downloads: 279382 * First seen: 14 September 2026 at

The Weekly Dependency Threat Report: 2026-09-12

15 Sep 2026 - 4 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. tailwindcss-contact-forms (npm) * Package: https://www.npmjs.com/package/tailwindcss-contact-forms * Severity: critical * Affected versions: 0.5.6 * Downloads: 1417 * First seen: 10 September 2026 at

The Weekly Dependency Threat Report: 2026-09-05

7 Sep 2026 - 10 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @crysnovax/baileys (npm) * Package: https://www.npmjs.com/package/@crysnovax/baileys * Severity: critical * Affected versions: 2.8.3 * Downloads: 4127 * First seen: 4 September

The Weekly Dependency Threat Report: 2026-08-29

30 Aug 2026 - 8 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @hd-team/app-dnpkg-beta (npm) * Package: https://www.npmjs.com/package/@hd-team/app-dnpkg-beta * Severity: critical * Affected versions: all * Downloads: 210389 * First seen: 27 August 2026 at