"Why I stopped trusting npm audit (and built my own)"

<p>In January and February 2026, security researchers filed <a href="https://www.heyuan110.com/posts/ai/2026-03-10-mcp-security-2026/" rel="noopener noreferrer">30 CVEs against

<p>I'm a cybersecurity engineer — 7 years in, currently a Security Policy Analyst, previously an Application Security Architect. I started building a SaaS product on the side and

<p>When you install an npm package, you can run <code>npm audit</code>. When you install a Python package, there's <code>pip-audit</code>. But when you install plugins that give

<p>When I built <a href="https://github.com/shrec/UltrafastSecp256k1" rel="noopener noreferrer">UltrafastSecp256k1</a> — a high-performance secp256k1 cryptography library

<p>Two independent security research groups published this week with findings that land on the same problem from different angles: AI agent skill files are a serious and

<p>On January 28, 2026, Moltbook launched to considerable fanfare. The pitch was bold: an "agent-first, human-second" social network where 1.5 million autonomous AI agents could

<p>Since <a href="https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/" rel="noopener noreferrer">npm v12 shipped on July 8</a>,

<h2> The 11pm key rotation </h2> <p>Two things have burned me more than once, and I suspect they've burned you too.</p> <p><strong>Incident one:</strong> a deploy that went green