Small Bytes (Page 2)

The Weekly Dependency Threat Report: 2026-08-22

24 Aug 2026 - 11 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. matrixflow-js (npm) * Package: https://www.npmjs.com/package/matrixflow-js * Severity: critical * Affected versions: 3.2.1 * Downloads: 1504353 * First seen: 19 August 2026 at

Trust Then Verify or Verify Then Trust? Choosing How ShieldedStack Handles the Unknown

19 Aug 2026 - 5 min read - Alex Wichmann

Security policies are easy when the answer is already known. A package is explicitly approved, explicitly denied, or has a known vulnerability above the organization's accepted threshold. The harder question is what to do when a developer requests a package

A simple architecture for securing every package

17 Aug 2026 - 4 min read - Alex Wichmann

Modern software supply chains are complicated enough, CI, local developer machines, multiple environments. The system protecting them should not add more complexity than necessary. ShieldedStack's long-running application architecture is built around three clear units: the Portal, the Proxy, and the

The Weekly Dependency Threat Report: 2026-08-15

17 Aug 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. spoint (npm) * Package: https://www.npmjs.com/package/spoint * Severity: medium * Affected versions: 0.1.695-0.1.700 * Downloads: 20346 * First seen: 11 August

The Weekly Dependency Threat Report: 2026-08-08

10 Aug 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @servicetitan/install (npm) * Package: https://www.npmjs.com/package/@servicetitan/install * Severity: high * Affected versions: 38.1.1, 38.1.2, 38.1.3,

The Weekly Dependency Threat Report: 2026-08-01

4 Aug 2026 - 7 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @andrewstory18/is-real-odd (npm) * Package: https://www.npmjs.com/package/@andrewstory18/is-real-odd * Severity: high * Affected versions: all * Downloads: 2460805 * First seen: 1 August 2026 at

The Weekly Dependency Threat Report: 2026-07-25

27 Jul 2026 - 2 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. yuinpm (npm) * Package: https://www.npmjs.com/package/yuinpm * Severity: high * Affected versions: 0.0.1-security * Downloads: 7767 * First seen: 23 July 2026 at

The Weekly Dependency Threat Report: 2026-07-19

19 Jul 2026 - 3 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. crypto-hasher (npm) * Package: https://www.npmjs.com/package/crypto-hasher * Severity: high * Affected versions: 0.0.1-security * Downloads: 1731879 * First seen: 15 July 2026 at