Tim Henrich Jan 9, 2026 3 min read

Inside a Typosquatting Campaign: 200 Malicious Packages in 48 Hours

Forensic analysis of a coordinated attack on PyPI that exploited human error at scale.

Read article

Tim Henrich Jan 5, 2026 3 min read

The Anatomy of a Software Supply Chain Attack

How attackers exploit trust relationships in package ecosystems to compromise thousands of organizations in a single stroke.

Read article

Tim Henrich Jan 2, 2026 3 min read

Dependency Confusion: Why Your Private Packages Aren't Private

A deep dive into the attack vector that allowed researchers to breach Apple, Microsoft, and PayPal using nothing but a package.json file.

Read article

Tim Henrich Jan 1, 2026 3 min read

What the xz Backdoor Taught Us About Long-Term Compromise

The near-miss catastrophe that almost gave attackers root access to most Linux systems, and what it reveals about open source trust.

Read article