Small Bytes (Page 3)

The Weekly Dependency Threat Report: 2026-06-14

15 Jun 2026 - 3 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. @builder.io/dev-tools (npm) * Package: https://www.npmjs.com/package/@builder.io/dev-tools * Severity: critical * Affected versions: 1.65.0 * Downloads: 35136 * First seen:

The Weekly Dependency Threat Report: 2026-06-07

8 Jun 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. puppeteer-core (npm) * Package: https://www.npmjs.com/package/puppeteer-core * Severity: critical * Affected versions: 25.1.0 * Downloads: 18014723 * First seen: 2 June 2026 at

The Weekly Dependency Threat Report: 2026-05-31

1 Jun 2026 - 3 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. events-channel (npm) * Package: https://www.npmjs.com/package/events-channel * Severity: critical * Affected versions: all * Downloads: 39778 * First seen: 25 May 2026 at 16:42

NuGet Supply Chain Security: A Practical Guide

29 May 2026 - 4 min read - Alex Wichmann

Your NuGet packages are a bigger attack surface than your code. Think about it: when was the last time you audited a dependency before running dotnet add package? You check the download count, maybe the GitHub stars, and move on. Meanwhile, you&

The Weekly Dependency Threat Report: 2026-05-25

25 May 2026 - 5 min read - Alex Wichmann

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. durabletask (pypi) * Package: https://pypi.org/project/durabletask/ * Severity: critical * Affected versions: 1.4.1-1.4.3 * Downloads: 386297 * First seen: 19 May 2026

Sidecars in Docker Compose: adding infrastructure behavior without reopening the app

18 May 2026 - 5 min read - Alex Wichmann

There's a very normal point in a container setup where a service stops being “just a service” and starts dragging infrastructure concerns in behind it. A Postgres container needs better log handling. A vendor image needs a reverse proxy in

GitHub Actions Security Checklist for the Supply Chain Attack Era

16 May 2026 - 5 min read - Alex Wichmann

GitHub Actions is one of the most convenient ways to automate builds, tests, releases, and deployments. It is also one of the easiest places to accidentally hand attackers a path into your software supply chain when workflow trust boundaries are too loose.

Open Sourcing obfuscan: Catch Obfuscated Backdoors Before They Land

28 Apr 2026 - 4 min read - Alex Wichmann

Supply-chain attacks rarely start with something obvious. They usually start with code that looks annoying to review: a long encoded string, a weird install script, a dynamic eval, a base64 decoder feeding a runtime execution sink, or some dependency update that adds