Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams26 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All26 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

26 articles in Security Engineers · Standards · Clear filtersSort byNewest·Trending

Setting Up AI-Powered Vulnerability Scanning After Mozilla's Claude Mythos Success

Standards

Latest

5 min read

Setting Up AI-Powered Vulnerability Scanning After Mozilla's Claude Mythos Success

Mozilla scanned Firefox using Opus 4.6, then gave Claude Mythos access to the codebase. The AI model identified 271 vulnerabilities in Firefox 150. This was not a research project or a proof of concep

For Security EngineersRead article

Repository Lockdown Runbook: Your First-Hour Response Template

Standards

5 min read

Repository Lockdown Runbook: Your First-Hour Response Template

When you discover unauthorized access to your GitHub organization, the first 60 minutes determine whether you contain the breach or watch it spread to every downstream dependency. This runbook provide

For Security EngineersRead

Hardening Open-Source Maintainer Accounts After the Axios Compromise

Standards

4 min read

Hardening Open-Source Maintainer Accounts After the Axios Compromise

The compromise of the Axios npm package through social engineering highlights a critical vulnerability in the software supply chain: the security of your dependencies is only as strong as the people w

For Security EngineersRead

AI Package Repositories Just Got Weaponized: What the Xinference Attack Reveals

Standards

4 min read

AI Package Repositories Just Got Weaponized: What the Xinference Attack Reveals

On April 22, 2026, malicious versions of xinference appeared on PyPI, targeting AI inference servers with credential theft payloads that leave no persistent traces. This attack marks a tactical shift:

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Standards

Malicious npm Package Impersonates Bitwarden CLI: Three Attack Vectors in One

On April 23, 2026, Mend.io discovered a compromised package on npm masquerading as @bitwarden/cli version 2026.4.0. This package combined three attack mechanisms: a self-propagating npm worm, a GitHub

For Security EngineersRead

A Self-Propagating Worm Just Proved Your Dependency Security Model Is Broken

Standards

4 min read

A Self-Propagating Worm Just Proved Your Dependency Security Model Is Broken

Socket and StepSecurity detected a supply chain worm in npm packages that doesn t just steal credentials—it spreads itself. The attack, tracked as CanisterSprawl, uses postinstall hooks to exfiltrate

For Security EngineersRead

"We're drowning in CVEs" — What NIST's triage shift means for your vulnerability program

Standards

4 min read

"We're drowning in CVEs" — What NIST's triage shift means for your vulnerability program

Your team likely relies on the NVD scores to decide what to patch, with automation pulling CVSS data to prioritize remediation. Now, NIST is shifting its focus, having enriched nearly 42,000 CVEs in 2

For Security EngineersRead

NIST Just Handed You the CVE Problem—Here's What Happened Next

Standards

5 min read

NIST Just Handed You the CVE Problem—Here's What Happened Next

The Challenge Between 2020 and 2023, CVE submissions grew 263%. Last year alone, NIST enriched almost 42,000 CVEs—a 45% year-over-year increase. Then NIST announced it would no longer analyze every vu

For Security EngineersRead

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Standards

4 min read

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Your vulnerability management program is about to undergo a significant transformation. AI models that autonomously discover vulnerabilities at scale are now production tools. Your team needs a deploy

For Security EngineersRead

Audio Steganography in Package Attacks: Detection and Response Guide

Standards

4 min read

Audio Steganography in Package Attacks: Detection and Response Guide

Scope This guide focuses on detecting and mitigating supply chain attacks that use audio steganography to hide malicious payloads in software packages. Our case study is the March 27, 2026 compromise

For Security EngineersRead

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

Standards

5 min read

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

A compromised maintainer account on npm deployed a cross-platform Remote Access Trojan (RAT) through malicious versions of Axios, a widely used JavaScript HTTP client library. If your systems ran npm

For Security EngineersRead

AI-Generated Malware in Your Dependencies: Detection Checklist

Standards

5 min read

AI-Generated Malware in Your Dependencies: Detection Checklist

A recent campaign distributing over 300 poisoned packages shows how attackers now use AI to scale supply chain attacks. Your dependency scanning probably caught the known signatures, but it won t catc

For Security EngineersRead

"Wait, this package is suddenly asking for what permissions?"

Standards

5 min read

"Wait, this package is suddenly asking for what permissions?"

These questions started showing up in security Slack channels right after StepSecurity flagged two hijacked npm packages in the React Native ecosystem. These packages, with over 30,000 downloads per w

For Security EngineersRead

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Standards

4 min read

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Endor Labs researchers have identified 88 new malicious npm packages in the latest PhantomRaven campaign—81 of which are still available for download. These packages are actively stealing credentials

For Security EngineersRead

Stopping Self-Spreading Worms When You Can't Kill the Server

Standards

4 min read

Stopping Self-Spreading Worms When You Can't Kill the Server

On March 20, 2026, Aikido Security detected CanisterWorm spreading across the npm ecosystem. Within hours, it had compromised more than 50 packages across multiple scopes. The attack used the Internet

For Security EngineersRead

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Standards

5 min read

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Scope This guide covers detection and mitigation strategies for supply chain attacks using decentralized infrastructure for command-and-control operations. You ll learn to identify compromised package

For Security EngineersRead

Showing 1-16 of 26 articles

PreviousPage 1 of 2Next