Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
On 20 August 2026 three Rust crates were republished to depend on proc-macro1, whose build.rs downloaded a payload. They were live for 86 to 107 minutes. How to check your builds.
Hex.pm is running October brown-outs and will permanently disable HTTP Basic auth on its API on 1 November 2026. Migrate scripts to OAuth or API keys.
Registry by registry, who requires a second factor to publish and who relies on a linked account. Based on Andrew Nesbitt's 18 August 2026 survey, with what to do about the gaps.
Both the June node-gyp worm and the August ChainDrop worm plant files in .claude and .vscode that rerun malware after npm uninstall. A short audit for every repo.
On 9 June 2026, Socket reported 23 malicious PyPI versions in the Mini Shai-Hulud campaign, including packages named like MCP servers for OpenAI, LangChain and Ray.
On 1 June 2026 researchers reported 32 packages and 96 versions in the @redhat-cloud-services npm namespace backdoored with a Shai-Hulud variant called Miasma.
In June 2026 Socket traced 19 PyPI packages and 37 wheels to a Miasma branch called Hades. A .pth file runs the payload at interpreter startup, before any import.
A maintainer account takeover put 20 packages in the LeoPlatform and RStreams families on a Miasma worm that runs through binding.gyp, while a popular release action had its tags redirected.
npm audit signatures checks that installed packages carry valid registry signatures and provenance attestations. Here is the command, real output, and its limits.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
