Tag: #npm

← All posts

• Dependency Supply Chain Security — The Things a Lockfile Does Not Block

  You wrote a dozen or so packages into package.json, yet more than a thousand get installed. This post explains why transitive dependencies are riskier than direct ones, and uses a real lockfile entry to show why an integ

  2026-07-26 · 14 min read #security#supply-chain#npm#sbom#ci

• The 3-Hour axios Account Takeover — Provenance Was On, and Nobody Checked It

  At 00:21 UTC on March 31, 2026, a malicious version 1.14.1 landed on axios, a package with over 80 million weekly downloads. What makes this case interesting is that axios was already using npm trusted publishing — the l

  2026-07-16 · 18 min read #security#supply-chain#npm#nodejs#devsecops

• Why npm supply-chain attacks won't go away — what npm-scan actually checks, and the defenses that work

  npm supply-chain attacks are not isolated accidents but a recurring product of install scripts, transitive dependencies, and typosquatting. In 2025 the Shai-Hulud worm self-replicated through install scripts and harveste

  2026-07-11 · 7 min read #npm#supply-chain#security#javascript#nodejs

• Anatomy of npm Supply Chain Attacks — Defense Strategies for the Era When Even Red Hat Got Hit

  Triggered by the June 2026 incident in which even official Red Hat Cloud Services npm packages were exposed to malicious code, this post dissects the types of npm supply chain attacks and lays out the defense stack organ

  2026-06-12 · 17 min read #npm#supply-chain#security#devops#sigstore

• The Complete Guide to Package Managers — How npm, uv, RPM, and Homebrew Work and How to Publish Software

  How does npm work? Why is uv so fast? What is RPM? How do you submit software to Homebrew? A deep dive into how package managers work and how to distribute your own software.

  2026-04-12 · 15 min read #devops#npm#uv#rpm#homebrew