Tag
This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. puppeteer-core (npm) * Package: https://www.npmjs.com/package/puppeteer-core * Severity: critical * Affected versions: 25.1.0 * Downloads: 18014723 * First seen: 2 June 2026 at
Continue readingThis weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. events-channel (npm) * Package: https://www.npmjs.com/package/events-channel * Severity: critical * Affected versions: all * Downloads: 39778 * First seen: 25 May 2026 at 16:42
Continue readingYour NuGet packages are a bigger attack surface than your code. Think about it: when was the last time you audited a dependency before running dotnet add package? You check the download count, maybe the GitHub stars, and move on. Meanwhile, you&
Continue readingThis weekly list covers the ten most significant malicious or compromised packages recently observed in public registries. 1. durabletask (pypi) * Package: https://pypi.org/project/durabletask/ * Severity: critical * Affected versions: 1.4.1-1.4.3 * Downloads: 386297 * First seen: 19 May 2026
Continue readingGitHub Actions is one of the most convenient ways to automate builds, tests, releases, and deployments. It is also one of the easiest places to accidentally hand attackers a path into your software supply chain when workflow trust boundaries are too loose.
Continue readingIn ShieldedStack, the Control Plane frontend doesn’t manually define API calls. Instead, it consumes a fully generated, strongly typed TypeScript client. Built directly from the backend’s OpenAPI specification using Kiota. This approach keeps the frontend and backend in lockstep, eliminates
Continue reading