git checkout

git branch

git commit -s

Sonar

The listen.dev Blog

Spam-pm: Investigating the Spam Invasion of npm

A deep dive into escalating spam problem on npm, and exploring the registry's unwanted guests.

Spam in npm

From Confusion to Compromise: Dependency Confusion Attacks
A primer on dependency confusion attacks
Published by Garnet Research (@research)
By
Date
January 10, 2023
Reading time
· 4 min
Read more
Beyond Known CVEs: Understanding Supply Chain Attacks
A post explaining key differences between two cybersecurity threats: known vulerabilities and supply chain attacks.
Published by Farrukh Jadoon (@fkj) and Umar Sikander (@us)

By and
Date
January 5, 2023
Reading time
· 4 min
Read more
Debunking Security for Developers (Part 1)
A primer for developers on commonly used buzz words in security.
Published by Farrukh Jadoon (@fkj) and Umar Sikander (@us)

By and
Date
November 1, 2022
Reading time
· 9 min
Read more
Super Dependence In Modern Software
A primer on transitive dependencies in open source software and how it results in super dependence.
Published by Farrukh Jadoon (@fkj) and Umar Sikander (@us)

By and
Date
November 1, 2022
Reading time
· 9 min
Read more
All your domains are belong to us
Let's discuss one of the most underrated but effective attack vectors: using expiring domains to take over npm packages.
Published by Garnet Research (@research)
By
Date
October 4, 2022
Reading time
· 10 min
Read more
The worst fear of a JavaScript developer
A discussion on the risks of transitive dependencies in JavaScript.
Published by Farrukh Jadoon (@fkj) and Umar Sikander (@us)

By and
Date
October 4, 2022
Reading time
· 7 min
Read more