Supply chain
A hands-on technical breakdown of the June 2026 AUR supply-chain attack — the real PKGBUILD payload chain, how to hunt for it on your box, and how to scan before you build.
Kief Studio
Engineering
Most AI tools are a GPT call with a markup. Here's how to tell which ones are worth it.
Kief Studio
Web security
Over half the tools you use to build software scored a C or worse on their own security headers.
Kief Studio
Web security
Most AES-GCM code on the internet is wrong. Not "suboptimal" wrong. Not "could be better" wrong.
Kief Studio
Web security
Your == operator is a snitch. Every time your code compares a password hash, API key, or webhook signature using standard string equality, it leaks information.
Kief Studio
Engineering
You want to ship one extension to three browsers. You've read that WebExtensions is a "standard." You've been lied to.
Kief Studio
Supply chain
NVD is drowning in backlog. OSV.dev aggregates 24 sources, tracks malicious packages, and doesn't need a government contract to stay alive.
Kief Studio
Supply chain
Your node_modules folder has 1,200 packages in it. You wrote maybe 15 of them.
Kief Studio
Supply chain
Your scanner just lit up red again. lodash. Prototype pollution. CVSS 9.1. Critical. You've seen this alert before. Probably dozens of times.
Kief Studio
Supply chain
You run npm audit . It screams at you. 47 vulnerabilities. 12 critical. You spend an hour investigating. Three of them are in dev dependencies that never ship.
Kief Studio
Web security
Your site works in Chrome on your laptop. The padlock is green. Everything looks fine. Then a webhook fails. A mobile user gets a security warning.
Kief Studio
Supply chain
You haven't opened package-lock.json in years. Neither has anyone on your team.
Kief Studio
Supply chain
On March 31, a maintainer account got popped and axios@1.14.1 shipped to npm with a trojanized dependency called plain-crypto-js .
Kief Studio
Supply chain
In 2025, 454,648 malicious npm packages were published. The registry has about 10 million packages total.
Kief Studio
Supply chain
Run npm ls fs in any non-trivial Node.js project. Go ahead, I'll wait.
Kief Studio
Supply chain
Run npm audit on any non-trivial project and you'll get a wall of red. Critical vulnerabilities. High severity. Dozens of them. Now go read the actual advisories.
Kief Studio
Web security
You set up DNS once, mass-pasted some records your hosting provider told you to add, and never looked again. That was fine in 2020. It's not fine now.
Kief Studio
Supply chain
Last month we pointed Vekt at every lockfile across our client portfolio. 221 lockfiles. 69,419 packages. 6 ecosystems. One Rust binary and a pot of coffee.
Kief Studio