Security
Your AI Pair Programmer Has Terrible Taste in Dependencies
- Konrad Madej
- AI
- 18 Jul, 2026
In October 2025, someone committed 47 AI-generated "agent skills" to a popular GitHub repository of shared assistant configurations. One of them told coding agents to run a package called react-codesh
read more
Dependabot Says Update Now. Supply-Chain Attacks Say Slow Down.
- Konrad Madej
- DevOps
- 18 Jul, 2026
On September 8, 2025, someone phished the maintainer of chalk and debug, two of the most downloaded packages on npm. The malicious versions were live for about two hours before they were pulled. In th
read more