ChainDrop: when malicious npm packages spread themselves
What ChainDrop teaches us about credential theft, self-propagating npm malware, and practical supply-chain defenses.
#Security
COLDCARD's weak randomness flaw and wallet seed security
Why a firmware update cannot repair wallets created with weak COLDCARD seed randomness.
WebMCP and websites designed for agents
How a website can expose structured actions to an AI agent while preserving authorization and user confirmation.
React2Shell and the attack surface of React Server Components
Why React2Shell means frontend teams must understand server vulnerabilities and patching too.
The end of npm classic tokens and safer package publishing
Why package publishing is moving from long-lived npm tokens toward short-lived credentials.
S1ngularity: the Nx package supply-chain attack
A review of the Nx S1ngularity attack and the protections frontend teams can actually apply.
The Bybit incident and frontend risk in cold-wallet signing
What the Bybit cold-wallet incident teaches us about signing interfaces, blind signing, and multisig workflows.