Alex Wichmann - Small Bytes

The Weekly Dependency Threat Report: 2026-10-17

19 Oct 2026 - 4 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. orderly-plugin-liquidity-heatmap (npm) * Package: https://www.npmjs.com/package/orderly-plugin-liquidity-heatmap * Severity: high * Affected versions: 1.0.6 * Downloads: 1354 * First seen: 13 October 2026 at

The Weekly Dependency Threat Report: 2026-10-10

12 Oct 2026 - 6 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. tensorlake (npm) * Package: https://www.npmjs.com/package/tensorlake * Severity: critical * Affected versions: 0.5.144 * Downloads: 17569 * First seen: 8 October 2026 at

How to Block Malicious PyPI Packages Before Installation with pip, uv, and Poetry

6 Oct 2026 - 3 min read - Alex Wichmann

A developer runs pip install. Another team uses uv sync. A third uses Poetry. They all pull Python dependencies, but a security rule configured in one client does not automatically apply to the others. If you want to stop a disallowed package

The Weekly Dependency Threat Report: 2026-10-03

5 Oct 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. whalibmob (npm) * Package: https://www.npmjs.com/package/whalibmob * Severity: critical * Affected versions: 5.33.5 * Downloads: 4681 * First seen: 30 September 2026 at

5 Hidden Risks in Your package.json File

29 Sep 2026 - 4 min read - Alex Wichmann

A package.json file is easy to skim. You see the packages your team added, maybe a few scripts, and a version number beside each dependency. It feels like a reasonable picture of what your application installs. It is only the starting

The Weekly Dependency Threat Report: 2026-09-26

28 Sep 2026 - 4 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. rrs (pypi) * Package: https://pypi.org/project/rrs/ * Severity: high * Affected versions: all * Downloads: 2282 * First seen: 21 September 2026 at 04:23 UTC

The Weekly Dependency Threat Report: 2026-09-19

20 Sep 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. noblox-asset.js (npm) * Package: https://www.npmjs.com/package/noblox-asset.js * Severity: critical * Affected versions: all * Downloads: 279382 * First seen: 14 September 2026 at

The Weekly Dependency Threat Report: 2026-09-12

15 Sep 2026 - 4 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. tailwindcss-contact-forms (npm) * Package: https://www.npmjs.com/package/tailwindcss-contact-forms * Severity: critical * Affected versions: 0.5.6 * Downloads: 1417 * First seen: 10 September 2026 at