Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams88 Security Engineers753 Compliance Teams221 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All88 Incident702 General186 Standards88 Research61 Guides33 Deadlines11 Vendor News4 Legal2

88 articles in Standards · Clear filtersSort byNewest·Trending

Audio Steganography in Package Attacks: Detection and Response Guide

Standards

Latest

4 min read

Audio Steganography in Package Attacks: Detection and Response Guide

Scope This guide focuses on detecting and mitigating supply chain attacks that use audio steganography to hide malicious payloads in software packages. Our case study is the March 27, 2026 compromise

For Security EngineersRead article

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

Standards

5 min read

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

A compromised maintainer account on npm deployed a cross-platform Remote Access Trojan (RAT) through malicious versions of Axios, a widely used JavaScript HTTP client library. If your systems ran npm

For Security EngineersRead

The Pre-Commit Secrets Policy Your Developers Will Actually Use

Standards

6 min read

The Pre-Commit Secrets Policy Your Developers Will Actually Use

Your team committed 29 million new hardcoded secrets to public repositories in 2025—a 34% increase from the previous year. AI services contributed to 81% more leaks year over year, and internal reposi

For CISOsRead

Should You Lock Down Your Package Repository or Monitor It?

Standards

5 min read

Should You Lock Down Your Package Repository or Monitor It?

The Telnyx SDK compromise on PyPI presents your security team with a critical decision: do you restrict package installation at the perimeter, or do you allow flexibility and invest in runtime detecti

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

AI-Generated Malware in Your Dependencies: Detection Checklist

Standards

5 min read

AI-Generated Malware in Your Dependencies: Detection Checklist

A recent campaign distributing over 300 poisoned packages shows how attackers now use AI to scale supply chain attacks. Your dependency scanning probably caught the known signatures, but it won t catc

For Security EngineersRead

AI Component Inventory Template: Mapping Your LLM Dependencies in 72 Hours

Standards

6 min read

AI Component Inventory Template: Mapping Your LLM Dependencies in 72 Hours

The Pentagon s 180-day deadline to remove Anthropic technology exposes a fundamental gap: most organizations cannot precisely answer, where do we use AI? Only 31% of organizations report being fully e

For CISOsRead

"Wait, this package is suddenly asking for what permissions?"

Standards

5 min read

"Wait, this package is suddenly asking for what permissions?"

These questions started showing up in security Slack channels right after StepSecurity flagged two hijacked npm packages in the React Native ecosystem. These packages, with over 30,000 downloads per w

For Security EngineersRead

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Standards

4 min read

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Endor Labs researchers have identified 88 new malicious npm packages in the latest PhantomRaven campaign—81 of which are still available for download. These packages are actively stealing credentials

For Security EngineersRead

Stopping Self-Spreading Worms When You Can't Kill the Server

Standards

4 min read

Stopping Self-Spreading Worms When You Can't Kill the Server

On March 20, 2026, Aikido Security detected CanisterWorm spreading across the npm ecosystem. Within hours, it had compromised more than 50 packages across multiple scopes. The attack used the Internet

For Security EngineersRead

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Standards

5 min read

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Scope This guide covers detection and mitigation strategies for supply chain attacks using decentralized infrastructure for command-and-control operations. You ll learn to identify compromised package

For Security EngineersRead

Package Manager Security: A Four-Stage Implementation Playbook

Standards

5 min read

Package Manager Security: A Four-Stage Implementation Playbook

Every npm install or pip install you run pulls code from strangers into your production systems. ENISA s Technical Advisory for Secure Use of Package Managers (March 2026) breaks dependency management

For DevelopersRead

Malicious Packages on Packagist: A Detection and Response Reference

Standards

5 min read

Malicious Packages on Packagist: A Detection and Response Reference

Scope This guide focuses on detecting, preventing, and remediating malicious packages in PHP Composer dependency chains, specifically targeting threats from Packagist . It covers reconnaissance method

For DevelopersRead

Should You Update Chrome Every Two Weeks?

Standards

4 min read

Should You Update Chrome Every Two Weeks?

Starting September 2026, Chrome will move to a two-week release cycle with version 153. If you re managing web applications in production, you need a clear decision framework for how your team respond

For DevelopersRead

How a Platform Team Cut Policy Sprawl by 60% with Unified Kubernetes Governance

Standards

5 min read

How a Platform Team Cut Policy Sprawl by 60% with Unified Kubernetes Governance

The Challenge Your platform engineering team might be managing multiple Kubernetes clusters across various environments. A common issue is policy chaos. One team adopted Kyverno as their policy engine

For Compliance TeamsRead

CMMC Questions Your Procurement Team Is Actually Asking

Standards

4 min read

CMMC Questions Your Procurement Team Is Actually Asking

These questions arise from recent experiences with contractors navigating the implications of the Cybersecurity Maturity Model Certification (CMMC) for their supplier relationships. With the Departmen

For Compliance TeamsRead

"We generate SBOMs, but nobody looks at them" — fixing the gap between SBOM creation and action

Standards

5 min read

"We generate SBOMs, but nobody looks at them" — fixing the gap between SBOM creation and action

Teams often find themselves generating Software Bill of Materials (SBOMs) without knowing how to use them effectively. They might have set up SBOM tooling in their CI/CD pipeline, generating thousands

For DevelopersRead

Showing 33-48 of 88 articles

PreviousPage 3 of 6Next