Xygeni Blog

Must-Read Posts

JavacDoor, Maven Malware That Runs at Compile Time

JavacDoor: A Maven Artifact That Ran During Compilation, Not Installation

QuietPolyfill, an NPM dropper that resurrected

QuietPolyfill: An NPM dropper that resurrected

rogue by design

Rogue by Design: How a Sandboxed Pre-Release Model Jailbroke Itself and Hacked Hugging Face to Cheat an Exam

PointBlank: PyPI RAT Hides C2 in a JSON-Bin Service

PointBlank: a fully-featured Python RAT that ran its command channel through a free note-hosting service

PhantomSync: npm Crypto Packages Hide Wallet Stealer

PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper

FauxUV: Fake PyPI uv Packages Open Jupyter to the Web

FauxUV: fake PyPI uv helpers that open an unauthenticated Jupyter server to the internet

slsa attestation - slsa framework - SLSA v1.2

Build Security

SLSA v1.2 : Updates to the SLSA Framework Explained

December 5, 2025

OWASP Top 10 2025 -owasp top ten - OWASP Top 10

SDLC

OWASP Top 10 2025 Explained for Developers

December 3, 2025

shai hulud - npm supply chain attack

Attacks Analysis

Shai-Hulud 2.0 NPM Supply Chain Attack

November 28, 2025

AI

AI for Coding Explained: 10 Simple Answers Developers Need

November 21, 2025

AI

Agentic AI: The Complete Guide for Developers, AI Engineers, and AppSec Teams

November 21, 2025

SDLC

Black Hat Europe 2025: Meet Xygeni at Booth 221

November 19, 2025

dockerfile secrets - dockerfile secrets environment variables

Secrets Security

Dockerfile Secrets: Why Layers Keep Your Sensitive Data Forever

November 19, 2025

docker build args - build args docker - docker build build arg

Secrets Security

Docker Build Args: The Hidden Vector for Secret Leaks in Images

November 19, 2025

task.run c# - async programming - parallel execution

Code Security

Task.Run in C#: The Wrong Way to Parallelize Secure Code

November 18, 2025

path traversal attack - file upload vulnerability

Code Security

Path Traversal in File Uploads: How Developers Create Their Own Exploits

November 18, 2025

bepinex.configurationmanager

Code Security

BepInEx.ConfigurationManager: How Insecure Settings Expose Sensitive Data

November 17, 2025

hangfire .net - background job processing c#

Code Security

Hangfire .NET Jobs: How Background Tasks Create Hidden Vulnerabilities

November 17, 2025