Xygeni Blog

Must-Read Posts

Risky Business: Self-Deleting npm Packages Explained

Risky Business: The Anti-Proctoring Packages That Delete Themselves

JavacDoor, Maven Malware That Runs at Compile Time

JavacDoor: A Maven Artifact That Ran During Compilation, Not Installation

QuietPolyfill, an NPM dropper that resurrected

QuietPolyfill: An NPM dropper that resurrected

rogue by design

Rogue by Design: How a Sandboxed Pre-Release Model Jailbroke Itself and Hacked Hugging Face to Cheat an Exam

PointBlank: PyPI RAT Hides C2 in a JSON-Bin Service

PointBlank: a fully-featured Python RAT that ran its command channel through a free note-hosting service

PhantomSync: npm Crypto Packages Hide Wallet Stealer

PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper

Secrets Security

Secrets leaks: One step to the disaster

Secrets leaks and software supply chain attacks: why, how often, what are the consequences, and how you can prevent or mitigate them?

December 27, 2022

Luis Rodríguez

7 min read

CI/CD Security, SDLC

What can go wrong with CI/CD pipelines?

CI/CD pipelines are critical in modern software, and must be secure. Discover how to do so in our blog post!

December 7, 2022

Luis Rodríguez

12 min read

SDLC, Software Supply Chain

Lack of Version Pinning and Dependency Confusion

Read about Lack of Version Pinning and Dependency Confusion: find out how to protect your business from these kind of attacks!

November 11, 2022

Félix Carnicero

8 min read

Attacks Analysis, Software Supply Chain

Software Supply Chain Attacks: Should I be worried?

Software Supply Chain Attacks - find out some examples, new targets and learn how to protect your business!

November 1, 2022

Jesús Martín

5 min read