Xygeni Blog

Must-Read Posts

JavacDoor, Maven Malware That Runs at Compile Time

JavacDoor: A Maven Artifact That Ran During Compilation, Not Installation

QuietPolyfill, an NPM dropper that resurrected

QuietPolyfill: An NPM dropper that resurrected

rogue by design

Rogue by Design: How a Sandboxed Pre-Release Model Jailbroke Itself and Hacked Hugging Face to Cheat an Exam

PointBlank: PyPI RAT Hides C2 in a JSON-Bin Service

PointBlank: a fully-featured Python RAT that ran its command channel through a free note-hosting service

PhantomSync: npm Crypto Packages Hide Wallet Stealer

PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper

FauxUV: Fake PyPI uv Packages Open Jupyter to the Web

FauxUV: fake PyPI uv helpers that open an unauthenticated Jupyter server to the internet

EVMDeFi npm Typosquatting Attack Steals Developer Keys

Attacks Analysis

EVM/DeFi npm Typosquatting Attack Steals Developer Keys

May 6, 2026

FauxCode When Your Reverse-Engineered Claude Code Quietly Routes Through the Attacker

Attacks Analysis

FauxCode: Reverse-Engineered Claude Code Routes Through Attackers

May 4, 2026

DevTap npm Typosquatting Attack

Attacks Analysis

DevTap npm Typosquatting Attack: Six Malicious Packages Target Developer Workstations

May 4, 2026

Secure AI-Generated Code

AI

How to Secure AI-Generated Code in CI/CD

April 29, 2026

AppSec Alert Fatigue

Software Supply Chain

How to Reduce AppSec Alert Fatigue

April 27, 2026

Cloud Security Tips

Software Supply Chain

20 Cloud Security Tips for Modern DevSecOps Teams

April 26, 2026

MTTR

AI

MTTR in AppSec: How to Reduce it with AI & Automation

April 24, 2026

inject environment variables to the build process

CI CD Security

Inject Environment Variables to the Build Process Securely

April 21, 2026

Axios npm Compromise

Attacks Analysis

Axios npm Compromise: What Happened, Who Is Affected, and How to Prevent It

April 16, 2026

Global InfoSec Awards

AI

Xygeni Wins Two Global InfoSec Awards for ASPM and GenAI Application Security

April 1, 2026

ReDoS

CI CD Security

ReDoS Explained: What Regular Expression DoS Is and How to Prevent It

March 30, 2026

Autofix in AppSec

AI

Autofix in AppSec: How to Remediate Vulnerabilities Without Breaking Builds

March 30, 2026