Blog

AI coding agents select vulnerable dependencies 50% more often than humans. Slopsquatting turns hallucinated package names into real malware. Here is how to protect your team.

North Korean threat actors hijacked the most popular HTTP library on npm. Four nproxy rules would have caught it.

From crossenv to axios: a chronological walkthrough of every major npm supply chain attack and the patterns that repeat.

Security tools that require developer interaction get ignored or bypassed. The best security is invisible.

The 2018 event-stream compromise showed why install-path policy checks matter before packages land in builds.

The 2021 ua-parser-js hijack exposed 24 million weekly downloads to cryptominers and credential stealers.

Five npm security controls mapped to real incidents: event-stream, ua-parser-js, node-ipc, colors/faker, and typosquat attacks.

Real npm typosquat incidents and how nproxy blocks suspicious packages at install time.