Supply Chain

What happens when the packages you depend on stop being trustworthy.

Laptop showing npm package security alert and dependency warning overlay

Security MAY 25, 2026 9 Min Read

The Three Hours Axios Belonged to Someone Else

Exploring the axios npm supply chain attack reveals a concerning story: a fake startup founder, a hijacked maintainer account, malware hidden in a popular JavaScript library, and a challenging 3-hour cleanup. It highlights the importance of vigilance in the open-source community.

Read full dispatch

Hand holding a tablet with an all-green vendor security checklist, arrows pointing to a magnifying glass revealing a past-dated warning icon

Security DEC 1, 2023 9 Min Read

What a Vendor Security Questionnaire Actually Proves — and What It Can't

A vendor security questionnaire proves a dated self-report, not a working control. See what it really answers and which checks you still owe afterwards.

Read full dispatch