Category: Build Security

Must-Read Posts

Risky Business: Self-Deleting npm Packages Explained

Risky Business: The Anti-Proctoring Packages That Delete Themselves

JavacDoor, Maven Malware That Runs at Compile Time

JavacDoor: A Maven Artifact That Ran During Compilation, Not Installation

QuietPolyfill, an NPM dropper that resurrected

QuietPolyfill: An NPM dropper that resurrected

rogue by design

Rogue by Design: How a Sandboxed Pre-Release Model Jailbroke Itself and Hacked Hugging Face to Cheat an Exam

PointBlank: PyPI RAT Hides C2 in a JSON-Bin Service

PointBlank: a fully-featured Python RAT that ran its command channel through a free note-hosting service

PhantomSync: npm Crypto Packages Hide Wallet Stealer

PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper

Build Security, SDLC

SLSA v1.2 : Updates to the SLSA Framework Explained

December 5, 2025

Anomaly Detection, Build Security, Code Security, Open-Source Security, Secrets Security, Software Supply Chain

Create a Branch in GitHub and Merge Safely

July 8, 2025

Build Security

The Power of SAST Tool for SQL Injection Vulnerability

January 28, 2025

Build Security

Build Artifacts Management Tools: Secure Your CI/CD

January 24, 2025

Build Security, IaC, SDLC

Software Attestation in Build Security – An Introduction

March 28, 2024