Billets à la une
All posts
npm no longer runs install scripts: pnpm did it first
Since 8 July 2026, npm install no longer runs the preinstall and postinstall scripts of your dependencies. It is the first break in that behaviour in sixteen years, and the end of the most profitable attack vector in the JavaScript ecosystem. Except pnpm did it eighteen months earlier, and PyPI has been setting the pace since 2023. Here is the real state of hardening, ecosystem by ecosystem.
Read the article When your GitHub repositories become someone else's attack infrastructure
I am used to package compromises: a malicious version ships to npm or PyPI, and whoever installs it runs the attacker's code. The campaign analysed by Socket on 22 July 2026 describes something else entirely. Installing the compromised package runs nothing at all: the library code is clean. What is tampered with are the GitHub Actions workflow files at the root of the repositories, turning every repository into a distributed Internet scanner tasked with exploiting a critical flaw in cPanel and WHM. I cover the mechanism, the real scale, and what I take away for our own pipelines.
Read the article A secure software factory on Incus, not on Kubernetes
I have just spent several days digging through Incus OS to build a complete private cloud: a cluster, Ceph storage, OVN virtual networks, security groups and multi-tenancy with quotas. Except an empty private cloud is useless. Here I lay out the blueprint for what I want to run on it: a multi-tenant DevSecOps software factory, one tenant per stage, with the full path of a commit through to production. Above all, I explain why I ruled out Kubernetes for this particular case.
Read the article AWX has had no release for two years: the risk and the fix
AWX has not shipped a release since July 2024. A conversation at Devoxx pushed me to check what that means in practice: I scanned the latest official image and found 45 CVEs, three of them critical. I explain why a frozen image mechanically becomes a stockpile of vulnerabilities, I rule out two tempting but flawed workarounds that get suggested to me often, and I lay out the option I now recommend, Ascender. This post complements the AWX hub covering concepts, installation and operations.
Read the article
Chainguard Actions: hardening the GitHub Actions you did not write
On 17 March 2026, Chainguard announced Chainguard Actions: an offering that ingests the most widely used GitHub Actions, hardens them automatically, then republishes secured versions you consume instead of the originals. I will say it plainly, this is an excellent move, and one of the few recent announcements aimed at the right link in the CI/CD supply chain. I unpack how it works, how the community received it, and why it does not replace a pipeline scanner like plumber: hardening actions and validating the chain are two different problems.
Read the article
Incus OS: I built a cluster without ever opening the UI
In November 2025, Stéphane Graber announced Incus OS: an immutable system that runs exactly one thing, Incus. No packages to manage, no configuration drift, and above all no shell. Everything goes through an authenticated API. I wanted to see what that means in practice, with a deliberately uncomfortable goal: build a three node cluster without ever opening the web interface. I go through the pitfalls that cost me a full cycle, the hardware prerequisites that genuinely block you, and where the project actually stands today.
Read the article
GitHub Actions: checkout v7 finally blocks pwn requests
For weeks I have been repeating the same warning: pull_request_target plus a fork checkout is an open door to your secrets. That is the pwn request. GitHub finally ships a default guardrail in actions/checkout v7. Here is what it changes, the exception to watch, and why the July 16 backport will protect almost every repository.
Read the article
Atomic Arch: 400 AUR packages hijacked, and the registry reflex I keep
On 11 June 2026, an attack named Atomic Arch hijacked 408 packages in the Arch User Repository, then more than 1,500 the following day. The method is uncomfortably simple: adopt orphaned packages, booby-trap their PKGBUILD, and run malicious code at install time. The payload combines a stealer written in Rust with an eBPF rootkit. I run Arch daily, and this campaign forced me to treat the AUR for what it really is: a dependency registry like any other, with the controls that come with it.
Read the article
CRA: is your software affected by the Cyber Resilience Act?
The Cyber Resilience Act has been in force since 10 December 2024, but its first real operational deadline arrives on 11 September 2026 with the obligations to report exploited vulnerabilities. Many teams still think it only targets connected devices: false. The CRA covers products with digital elements placed on the European market: installed software, firmwares, appliances, agents, SDKs, extensions, mobile apps. Before talking SBOM, compliance or penalties, one question: are you affected?
Read the article
Megalodon: why OIDC alone will not save you
For two years I have repeated the same advice: move to OIDC, drop your static access keys from GitHub secrets. That still holds, but after the May 2026 attacks and the 5,561 repositories booby-trapped by Megalodon, I no longer phrase it the same way. The problem is not OIDC: it is that OIDC became an end point in security conversations when it should be a starting point. It removes static credentials, not the temporary credentials exposed while the runner executes. I detail the four layers to stack around it, including a hardened trust policy and egress control.
Read the article
actions-cool/issues-helper: 53 tags point to a booby-trapped commit
On 18 May 2026, 53 tags of the GitHub action actions-cool/issues-helper were rewritten in under 3 minutes and 16 seconds to point at an impostor commit that exfiltrates CI/CD secrets from the memory of the Runner.Worker process. A second action from the same organisation was hit in the same window. I walk through how the impostor commit works, the indicators of compromise published by StepSecurity, and the only defence that actually holds: pinning by full commit SHA. I also show how to audit every workflow you own with a single command.
Read the article
GitHub is wobbling: is open source in crisis?
In a few weeks, GitHub has stacked up an internal security breach, sagging reliability and the departure of flagship projects. Many read it as the crisis of open source. I think we are conflating three things: GitHub the company, supply chain security, and open source itself. A post I will keep enriching over time.
Read the article