Xygeni Blog

Must-Read Posts

JavacDoor, Maven Malware That Runs at Compile Time

JavacDoor: A Maven Artifact That Ran During Compilation, Not Installation

QuietPolyfill, an NPM dropper that resurrected

QuietPolyfill: An NPM dropper that resurrected

rogue by design

Rogue by Design: How a Sandboxed Pre-Release Model Jailbroke Itself and Hacked Hugging Face to Cheat an Exam

PointBlank: PyPI RAT Hides C2 in a JSON-Bin Service

PointBlank: a fully-featured Python RAT that ran its command channel through a free note-hosting service

PhantomSync: npm Crypto Packages Hide Wallet Stealer

PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper

FauxUV: Fake PyPI uv Packages Open Jupyter to the Web

FauxUV: fake PyPI uv helpers that open an unauthenticated Jupyter server to the internet

ASPM

DAST Meets ASPM: Closing the Gap Between Code and Runtime Exposure

February 4, 2026

AI

AI-Powered Malware Detection in SSCS

January 22, 2026

OWASP GenAI Security Project - generative AI security - gen AI security

AI

OWASP GenAI Security Project

January 20, 2026

Shai-Hulud 3.0 - npm Malware Worn - shai-hulud malware

Attacks Analysis

Shai-Hulud 3.0: npm Malware Worn

January 16, 2026

weak application security

Software Supply Chain

How Weak Application Security Creates Digital Privacy Risks

January 16, 2026

application control engine - application client container - aspm

ASPM

Application Control Engine vs Client Container in ASPM

January 7, 2026

Broken Access Control - Security Misconfiguration - Managed Object Browser

SDLC

Managed Object Browser and Broken Access Control

December 23, 2025

Open-Source Security

Why purl Matters More Than You Think

December 19, 2025

Risk Based Vulnerability Management- cyber resilience act - cisa known exploited vulnerabilities catalog

Open-Source Security

Risk Based Vulnerability Management and CRA

December 18, 2025

mcp server - model context protocol - mcp ai project

AI

MCP Server in AI: Key Concepts Explained

December 18, 2025

software supply chain security - open source supply chain attacks - AI and software security - AI Security

Software Supply Chain

AI Security and the Expanding Software Supply Chain Attack Surface

December 16, 2025

React2Shell - CVE-2025-55182 - RCE risk

Attacks Analysis

React2Shell: CVE-2025-55182 and the Next.js RCE Risk

December 5, 2025