Lockfiles, malicious packages, scanners and the attacks that keep landing in registries.
Supply chain
A hands-on technical breakdown of the June 2026 AUR supply-chain attack — the real PKGBUILD payload chain, how to hunt for it on your box, and how to scan before you build.
Kief Studio
Supply chain
NVD is drowning in backlog. OSV.dev aggregates 24 sources, tracks malicious packages, and doesn't need a government contract to stay alive.
Kief Studio
Supply chain
Your node_modules folder has 1,200 packages in it. You wrote maybe 15 of them.
Kief Studio
Supply chain
Your scanner just lit up red again. lodash. Prototype pollution. CVSS 9.1. Critical. You've seen this alert before. Probably dozens of times.
Kief Studio
Supply chain
You run npm audit . It screams at you. 47 vulnerabilities. 12 critical. You spend an hour investigating. Three of them are in dev dependencies that never ship.
Kief Studio
Supply chain
You haven't opened package-lock.json in years. Neither has anyone on your team.
Kief Studio
Supply chain
On March 31, a maintainer account got popped and axios@1.14.1 shipped to npm with a trojanized dependency called plain-crypto-js .
Kief Studio
Supply chain
In 2025, 454,648 malicious npm packages were published. The registry has about 10 million packages total.
Kief Studio
Supply chain
Run npm ls fs in any non-trivial Node.js project. Go ahead, I'll wait.
Kief Studio
Supply chain
Run npm audit on any non-trivial project and you'll get a wall of red. Critical vulnerabilities. High severity. Dozens of them. Now go read the actual advisories.
Kief Studio
Supply chain
Last month we pointed Vekt at every lockfile across our client portfolio. 221 lockfiles. 69,419 packages. 6 ecosystems. One Rust binary and a pot of coffee.
Kief Studio