dependencies
9 articles with this tag
The TanStack, Nx Console and GitHub Compromise Chain (May 2026): What Developers Should Check
On May 11, 2026, the publishing pipeline of TanStack's Router/Start repository was abused to push credential-stealing code into 42 npm packages, 84 versions. An Nx contributor who installed one of them had a GitHub CLI token stolen, and on May 18 a tampered Nx Console extension (v18.95.0) was published. The same day, GitHub said an employee device had been compromised by a poisoned VS Code extension and GitHub-internal repositories were exfiltrated. In all three cases the attack went through legitimate accounts and distribution channels, so the defense is to make sure a single stolen publishing credential (token) is not enough to release a new version, and to verify that the safeguards you configured actually run.
Trivy Supply-Chain Compromise (March 2026): What to Do If You Run Trivy in CI
On March 19, 2026, a malicious v0.69.4 of Trivy, the open-source vulnerability scanner developed by Aqua Security, was released, and the GitHub Actions trivy-action (76 of 77 tags) and setup-trivy (all 7 tags) were repointed to malicious commits. According to Aqua, the malicious code collected secrets from CI runners and sent them out; the cause was credentials taken in a compromise that began in late February, which the attacker could keep using because the March 1 rotation was not done all at once. This site's take: the lesson is not only to pin actions by commit ID (SHA) instead of by tag. An action pinned by SHA can still call another component by tag, which lets a malicious version in. Leaked credentials must be replaced all at once, or the attacker can keep using them. Run scanners in jobs that hold no deployment secrets.
Prototype pollution in Node.js: what the runtime does not cover, and how to defend in your own code
Prototype pollution is what happens when a special key in external input reaches JavaScript's built-in prototypes, usually through a recursive merge. Two outcomes: properties you never set appear everywhere (breaking authorization and option checks), or built-in methods vanish and the app crashes somewhere unrelated. The part that matters most is ownership — Node.js states this is not a vulnerability in Node.js core, and that defenses belong at the application and dependency level. Waiting for an update will not fix it.
What is OpenSSL? The library that handles HTTPS encryption, and how to keep it safe
OpenSSL = the open-source library that powers HTTPS (TLS/SSL) and crypto. Most people never write it directly — they inherit it via the web server, OS, or language runtime. That's why one bug has an enormous impact (Heartbleed is the classic case). Defense: know which OpenSSL your stack uses, don't run EOL versions, include foundational libraries in CVE monitoring, and patch promptly. Even the certificates this site serves run crypto through an OpenSSL-family implementation underneath.
Fixing dependency CVEs for real: scan, fix, isolate, and keep watching
Vulnerability work isn't done when you 'fix it.' Done = 1) scan, 2) fix, 3) isolate/hand off, 4) monitor. Until monitoring (daily change-detection) is in place, it's incomplete — dependencies turn vulnerable again tomorrow. A perfect fix that the next deploy overwrites is worth zero. Small teams stay safe with two disciplines: automated change-detection and 'local→push→deploy.'
Installing and using osv-scanner: find CVEs in your dependencies automatically
osv-scanner scans lockfiles and containers to surface CVEs in your dependencies, free. This walks through install, run, and CI integration, plus when to use it vs npm/pnpm audit vs Dependabot. This site's view: which tool fits depends on your setup. Use osv-scanner on multi-ecosystem or GitHub-free projects, and the bundled pnpm audit for a single npm tree.
Log4Shell (CVE-2021-44228) — a logging library flaw, and why teams couldn't quickly tell if they used it
Log4j's CVSS 10.0 bug. The core problem was the transitive dependency: being affected through a library you didn't know you used. A passive logging path became an attack vector. SBOM, machine-monitoring, fast patching, and following the follow-up CVEs are the lessons.
The XZ Utils backdoor (CVE-2024-3094) — a supply-chain attack by a trusted co-maintainer
A trusted maintainer planted a backdoor in xz, a supply-chain attack. One engineer noticed logins were slow and found it just before stable releases. Code wasn't the target; people and trust were. Minimize dependencies, pin versions, build reproducibly, chase anomalies, and support maintainers.
Running Next.js safely: not falling behind on published CVEs
The top framework risk is neglected published CVEs. Defend with four practices: judge by the running version, monitor with Dependabot/osv-scanner, update fast, and run least-privilege. This site's view: what indie devs usually lack is not knowledge but a way to keep operations going; a system that doesn't miss CVEs matters more than speed.