Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Scan the lockfile, trace where each vulnerable package comes from, upgrade or override it with approvals, run npm ci and tests, then rescan to confirm.
Find vulnerable Java libraries, pin safe versions with Maven dependencyManagement or Gradle constraints, approve each step, test and rescan with the CLI.
Scan your Go module with the Safeguard CLI, upgrade the affected module with go get, tidy and test with your approval, then rescan before you commit.
Malware records usually list the exact versions someone analysed, and scanners match only those. 2026 OSV data for PyPI and npm, the leakdeep credential stealer whose version 2.6.2 isn't in its record, and a script that checks lockfiles by package name.
Free, no login tools a maintainer can use: Gold package and CVE pages, the in-browser scan, a CLI gate through the Gold scan package, and local scans before a release.
On 9 September 2026 npm extended a 72 hour security hold to every account that signs in with a recovery code, targeting the email change, new token, malicious publish pattern.
GitHub added a cache-mode setting on 10 September 2026 to limit who can write to the Actions cache. Socket ties it to the TanStack npm compromise and other cache poisoning cases.
Socket reported theme extensions on the VS Code Marketplace and Open VSX, two confirmed malicious, with a Solana dead drop for the next stage. Many cluster members are not confirmed.
Aikido found XCSSET macOS malware in the example folder of universal_file_viewer 0.1.5 on pub.dev. Depending on the package is not the risk; building its example is.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
