Xygeni Logo White
Start Free
Book a demo

Xygeni Blog

Must-Read Posts

Zero Trust SDLC

Keys to use AI cybersecurity, Zero Trust SDLC, how to secure AI-generated code, AI Security

Zero Trust SDLC means securing what AI produces and uses. Learn the five surfaces, real attacks, and how to close the AI security gap now.
10 min read
ai inventory software

What Is an AI Inventory? A Practical Guide to AI Asset Discovery, AI-BOM and Shadow AI

What is an AI inventory? A practical guide to AI asset discovery, AI-BOM generation, shadow AI, and EU AI Act compliance.
10 min read
DeviceDoor npm Package Shipping a Microsoft 365 Device-Code Phishing Framework

DeviceDoor: a public npm package shipping a Microsoft 365 device-code phishing and bulk-mail framework

DeviceDoor hides a device-code phishing framework inside an npm package. Learn how it works and how to defend against it.
7 min read
secure software supply chain, ai bom, mcp security

OWASP Global AppSec EU 2026 Vienna: Key Takeaways on Secure Software Supply Chain, MCP Security, and the AI-BOM

OWASP Vienna 2026 recap: AISVS launch, MCP security gaps, AI-BOM readiness & what the industry is saying about secure software supply chain
5 min read
OWASP GLOBAL Appsec AI Security

AI Security at OWASP Global AppSec EU 2026: Meet Xygeni in Vienna

Xygeni is at OWASP Global AppSec EU 2026, Booth G-08. Live AI Security demos, Zero Trust SDLC, and the team in Vienna. Come by!
7 min read
CryptoDAO Confusion: npm Packages Harvesting CI/CD and Crypto Secrets

CryptoDAO Confusion: eleven npm packages, one payload, harvesting CI/CD and crypto-wallet secrets

CryptoDAO Confusion: eleven npm packages at version 99.99.99 harvesting CI/CD tokens, cloud keys, and crypto wallet secrets on postinstall.
9 min read
Permission Slip: npm Package Hiding Cloud & System Threats

Permission Slip: An npm “Authorized Research” Cover Story Hiding Cloud-Metadata Probes and SYSTEM Persistence

Permission Slip: six malicious npm packages hide cloud-metadata probes and Windows SYSTEM persistence behind a fake research disclaimer.
9 min read
Ectoplasm npm Install Hooks That Steal AWS Credentials

Ectoplasm: npm install hooks that harvest AWS credentials behind a container-only trigger

Five npm packages silently harvest AWS credentials and Secrets Manager key, but only inside containers. How Ectoplasm evades detection.
11 min read
SeedSweep: Ten Malicious npm Crypto Packages

SeedSweep: Ten Crypto-Themed npm Packages That Only Run When No One Is Watching

SeedSweep: 10 npm packages stealing crypto wallets and SSH keys via Telegram. Silent in CI, deadly on dev machines. Dive in!
7 min read
PairLoop: Hidden Remote-Control Panel in npm Package

PairLoop: One npm Package, Seventy Versions, and a Hidden Windows Remote-Control Panel

PairLoop uncovers how a suspicious npm package deployed persistence, browser surveillance, and a hidden Windows remote-control panel.
12 min read
ConsentMask The npm Package Hiding Developer Identity Harvesting

ConsentMask: An npm Package That Wears a Telemetry Consent Banner Over Developer-Identity Harvesting

Take a look at ConsentMask, the npm package that harvested developer identities, GitHub accounts, and CI data via postinstall.
9 min read
AI-Driven SDLCs Are Already Here

AI-Driven SDLCs Are Already Here. Now What?

AI-Driven SDLCs Are Already Here. Now What? Learn how to secure AI-driven development with Zero Trust AppSec and full AI visibility.
9 min read
Load More