ChainDrop: when malicious npm packages spread themselves
What ChainDrop teaches us about credential theft, self-propagating npm malware, and practical supply-chain defenses.
Security
COLDCARD's weak randomness flaw and wallet seed security
Why a firmware update cannot repair wallets created with weak COLDCARD seed randomness.
The end of npm classic tokens and safer package publishing
Why package publishing is moving from long-lived npm tokens toward short-lived credentials.
An API key slipped into Git? GitHub's secret risk assessment
GitHub's free assessment helps organizations see their secret exposure, and why deleting a key from a file is not enough.
The Bybit incident and frontend risk in cold-wallet signing
What the Bybit cold-wallet incident teaches us about signing interfaces, blind signing, and multisig workflows.