Small Bytes

The Weekly Dependency Threat Report: 2026-09-12

15 Sep 2026 - 4 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. tailwindcss-contact-forms (npm) * Package: https://www.npmjs.com/package/tailwindcss-contact-forms * Severity: critical * Affected versions: 0.5.6 * Downloads: 1417 * First seen: 10 September 2026 at

The Weekly Dependency Threat Report: 2026-09-05

7 Sep 2026 - 10 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @crysnovax/baileys (npm) * Package: https://www.npmjs.com/package/@crysnovax/baileys * Severity: critical * Affected versions: 2.8.3 * Downloads: 4127 * First seen: 4 September

The Weekly Dependency Threat Report: 2026-08-29

30 Aug 2026 - 8 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @hd-team/app-dnpkg-beta (npm) * Package: https://www.npmjs.com/package/@hd-team/app-dnpkg-beta * Severity: critical * Affected versions: all * Downloads: 210389 * First seen: 27 August 2026 at

The Weekly Dependency Threat Report: 2026-08-22

24 Aug 2026 - 11 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. matrixflow-js (npm) * Package: https://www.npmjs.com/package/matrixflow-js * Severity: critical * Affected versions: 3.2.1 * Downloads: 1504353 * First seen: 19 August 2026 at

Trust Then Verify or Verify Then Trust? Choosing How ShieldedStack Handles the Unknown

19 Aug 2026 - 5 min read - Alex Wichmann

Security policies are easy when the answer is already known. A package is explicitly approved, explicitly denied, or has a known vulnerability above the organization's accepted threshold. The harder question is what to do when a developer requests a package

A simple architecture for securing every package

17 Aug 2026 - 4 min read - Alex Wichmann

Modern software supply chains are complicated enough, CI, local developer machines, multiple environments. The system protecting them should not add more complexity than necessary. ShieldedStack's long-running application architecture is built around three clear units: the Portal, the Proxy, and the

The Weekly Dependency Threat Report: 2026-08-15

17 Aug 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. spoint (npm) * Package: https://www.npmjs.com/package/spoint * Severity: medium * Affected versions: 0.1.695-0.1.700 * Downloads: 20346 * First seen: 11 August

The Weekly Dependency Threat Report: 2026-08-08

10 Aug 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @servicetitan/install (npm) * Package: https://www.npmjs.com/package/@servicetitan/install * Severity: high * Affected versions: 38.1.1, 38.1.2, 38.1.3,