MSManu Shuklainecorpit.hashnode.dev路4d ago 路 17 min read42 poisoned npm versions: the keyv worm containment runbook for 4 August 202642 poisoned npm versions: the keyv worm containment runbook for 4 August 2026 Summary. On 4 August 2026, an attacker took over the GitHub account of the maintainer behind keyv and published malware ac00
MSManu Shuklainecorpit.hashnode.dev路Jul 30 路 13 min readGitHub Dependabot malware alerts now cover npm, PyPI and more: how to turn them on (2026)GitHub Dependabot malware alerts now cover npm, PyPI and more: how to turn them on (2026) Summary. On 28 July 2026 GitHub started ingesting malware advisories from the OpenSSF malicious-packages proje00
PTPRANAV THAWAITinomnikon.hashnode.dev路Jul 24 路 5 min readBuilt a React Library That Makes Google Drive Work Like an Image CDNI Built a React Library That Makes Google Drive Work Like an Image CDN Have you ever stored images in Google Drive and thought: "Why can't I just use this link in my React app?" I certainly did. Aft00
MSManu Shuklainecorpit.hashnode.dev路Jul 23 路 11 min readSoftware supply chain security in 2026: an enterprise playbook after the npm attack waveSoftware supply chain security in 2026: an enterprise playbook after the npm attack wave Summary. In four days in July 2026, two npm supply chain attacks showed why perimeter thinking fails. On 11 Jul00
Uu84uinu84u.hashnode.dev路Jul 22 路 3 min readphotu: shell pipe CLI for batch image processing馃摳 photu turns shell pipes into one fused libvips pass, instead of typing ImageMagick incantations you can never remember. I can never remember ImageMagick's flags. Something like this: $ magick mog00
PKPrashant Koiralainblog.prashantkoirala.info.np路Jul 21 路 22 min readSoftware publishing is moving beyond long-lived tokensPublishing software used to depend on a secret. A maintainer created an API token in a package registry, copied it into a CI secret store, and allowed a workflow to use it every time a release was pub00
VYVincent Yanginvincent4486.hashnode.dev路Jul 21 路 7 min readBe Careful of Your DependenciesOriginally posted at blog.vyang.org. Starting from a situation I encountered, just when I am writing this blog: My operating system -- Valecium is currently still in the alpha stage. It does not provi00
MSManu Shuklainecorpit.hashnode.dev路Jul 17 路 23 min read84 malicious npm versions in 6 minutes: the 2026 TanStack trusted-publishing breach and the CI config that stops it84 malicious npm versions in 6 minutes: the 2026 TanStack trusted-publishing breach and the CI config that stops it Summary. On 11 May 2026, between 19:20 and 19:26 UTC, an attacker published 84 malic00
ADAniket Deyinblog.aniketdey.in路Jul 15 路 3 min readStop Committing Secrets: Automatically Generate .env.example with gen-envexWhen working on Node.js, React, Next.js, or any modern application, one of the first things you'll create is a .env file. It stores everything from database credentials to API keys and authentication 53CM
MSManu Shuklainecorpit.hashnode.dev路Jul 16 路 14 min readnpm 12 shipped on 8 July 2026 with install scripts off by default: the CI fixnpm 12 shipped on 8 July 2026 with install scripts off by default: the CI fix Summary. GitHub made npm v12 generally available on 8 July 2026 and tagged it latest. Three npm install behaviours that ra00
