Billets à la une
All posts
npm no longer runs install scripts: pnpm did it first
Since 8 July 2026, npm install no longer runs the preinstall and postinstall scripts of your dependencies. It is the first break in that behaviour in sixteen years, and the end of the most profitable attack vector in the JavaScript ecosystem. Except pnpm did it eighteen months earlier, and PyPI has been setting the pace since 2023. Here is the real state of hardening, ecosystem by ecosystem.
Read the article When your GitHub repositories become someone else's attack infrastructure
A campaign turns GitHub Actions into a distributed scanner for CVE-2026-41940 on cPanel and WHM. Installing the package runs nothing: the repo is the weapon.
Read the article A secure software factory on Incus, not on Kubernetes
Field report: after building an Incus private cloud, I lay out the blueprint of a multi-tenant DevSecOps software factory, and explain why not Kubernetes.
Read the article AWX has had no release for two years: the risk and the fix
AWX has shipped no release since July 2024. I scanned the official image: 45 CVEs, 3 critical. Why it happened, what I tested, and the option I settled on.
Read the article
Chainguard Actions: hardening the GitHub Actions you did not write
Chainguard Actions rebuilds and hardens GitHub Actions from source. What it fixes, what the community pushed back on, and why a pipeline scanner still matters.
Read the article
Incus OS: I built a cluster without ever opening the UI
Hands-on with Incus OS, the shell-less immutable OS. A 3-node cluster built entirely through the API, the real pitfalls, and where the project stands.
Read the article
GitHub Actions: checkout v7 finally blocks pwn requests
For weeks I have been repeating the same warning: pull_request_target plus a fork checkout is an open door to your secrets. That is the pwn request. GitHub finally ships a default guardrail in actions/checkout v7. Here is what it changes, the exception to watch, and why the July 16 backport will protect almost every repository.
Read the article
Atomic Arch: 400 AUR packages hijacked, and the registry reflex I keep
Atomic Arch campaign: 400+ orphaned AUR packages adopted then boobytrapped (Rust stealer, eBPF rootkit). How it works and whether you are affected.
Read the article
CRA: is your software affected by the Cyber Resilience Act?
The Cyber Resilience Act has been in force since 10 December 2024, but its first real operational deadline arrives on 11 September 2026 with the obligations to report exploited vulnerabilities. Many teams still think it only targets connected devices: false. The CRA covers products with digital elements placed on the European market: installed software, firmwares, appliances, agents, SDKs, extensions, mobile apps. Before talking SBOM, compliance or penalties, one question: are you affected?
Read the article
Megalodon: why OIDC alone will not save you
OIDC removes static cloud credentials, not the temporary ones exposed inside the runner. Megalodon shows which layers to stack around OIDC.
Read the article
actions-cool/issues-helper: 53 tags point to a booby-trapped commit
Every tag of actions-cool/issues-helper points to an imposter commit that drains CI/CD secrets. Detection, IOCs and defense through SHA pinning.
Read the article
GitHub is wobbling: is open source in crisis?
In a few weeks, GitHub has stacked up an internal security breach, sagging reliability and the departure of flagship projects. Many read it as the crisis of open source. I think we are conflating three things: GitHub the company, supply chain security, and open source itself. A post I will keep enriching over time.
Read the article