Xygeni Blog

Must-Read Posts

JavacDoor, Maven Malware That Runs at Compile Time

JavacDoor: A Maven Artifact That Ran During Compilation, Not Installation

QuietPolyfill, an NPM dropper that resurrected

QuietPolyfill: An NPM dropper that resurrected

rogue by design

Rogue by Design: How a Sandboxed Pre-Release Model Jailbroke Itself and Hacked Hugging Face to Cheat an Exam

PointBlank: PyPI RAT Hides C2 in a JSON-Bin Service

PointBlank: a fully-featured Python RAT that ran its command channel through a free note-hosting service

PhantomSync: npm Crypto Packages Hide Wallet Stealer

PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper

FauxUV: Fake PyPI uv Packages Open Jupyter to the Web

FauxUV: fake PyPI uv helpers that open an unauthenticated Jupyter server to the internet

Code Quality Check vs. Code Security Check

Code Security

Code Quality Check vs. Code Security Check: What’s the Difference?

August 13, 2026

Vibe Coding Security

AI

Vibe Coding Security: What Happens When “It Works” Replaces “I Reviewed It”

August 12, 2026

Xygeni AI Shield

Open-Source Security

Xygeni AI Shield: Stop AI-Generated Malicious Packages

August 12, 2026

JavacDoor, Maven Malware That Runs at Compile Time

Attacks Analysis

JavacDoor: A Maven Artifact That Ran During Compilation, Not Installation

August 10, 2026

When AI Agents Install Dependencies

AI

AI Agent Supply Chain Security: What Stops a Bad Dependency When AI Agents Install It

August 10, 2026

API Security

Code Security

API Security Has Been a Runtime Problem. It Doesn’t Have to Be

August 7, 2026

Npm Supply Chain Attacks

Attacks Analysis

Npm Supply Chain Attacks: Biggest Incidents & How to Stop Them

August 6, 2026

How AI Agents Can Automate a Ransomware Attack

Attacks Analysis

How AI Agents Can Automate a Ransomware Attack: What JadePuffer Just Proved

August 4, 2026

Cyber Resilience Act timeline

ASPM

The Cyber Resilience Act Timeline: Every Deadline From 2024 to 2027

August 4, 2026

QuietPolyfill, an NPM dropper that resurrected

Attacks Analysis

QuietPolyfill: An NPM dropper that resurrected

August 3, 2026

cybersecurity threats

AI

Cybersecurity Threats in 2026: How AI Threats Are Reshaping the Attack

July 30, 2026

AI Attack Surface

Code Security

The AI Attack Surface Nobody Is Taking into Account

July 27, 2026