June 29, 2026

The install step is the most dangerous moment in your day

It is a Tuesday morning. A developer pulls a popular open-source package, one they have installed a hundred times, and runs the install. Nothing looks wrong: the progress bar fills, the prompt returns, they move on. What they cannot see is that the version they just pulled went up four hours ago, and that buried in its install script are a few lines that read their SSH keys and environment variables and post them to a server they have never heard of. By the time an advisory is filed, the keys are already gone.

Read the article →

June 20, 2026

TrapDoor: 34 packages went bad overnight, and a 3-day rule would have stopped them

In late May 2026, security researchers disclosed a supply-chain campaign that came to be known as TrapDoor. More than 34 malicious packages went up across PyPI, npm and Crates.io at roughly the same time. They were not broken or buggy. They were built to run hostile code the moment they were installed or imported, scraping SSH keys and credentials off the machine and sending them to the attackers (reported by The Hacker News , 25 May 2026).

Read the article →