Practical advice on integrating security into the software development process and test automation.
Malicious versions of keyv and related npm packages ran on their own during installation, pulled secrets from developer machines and CI runners, then published more infected packages. Here is how to check your exposure and what to do first.
Cloudflare AI Gateway centralizes traffic from applications, agents and automations to AI models. We show how to use logs, DLP, Guardrails, caching and spend limits - and what the service does not cover.
The main axios maintainer's account (100+ million downloads/week) was compromised - versions 1.14.1 and 0.30.4 installed a RAT trojan on macOS, Windows, and Linux. Full analysis with IOCs, remediation steps, and Aikido Safe Chain protection.
An analysis of the Shai-Hulud 2.0 attack on the npm ecosystem — 796 compromised packages, a dead man's switch, and how OX Security protects the software supply chain.