📰 Dev.to · Pico

One GitHub issue, nine days, four packages. Andrey Sitnik argued CI provenance makes things worse, then shipped Staged Publishing on postcss, nanoid, browsersli

Vite is the build tool behind most of the modern JavaScript ecosystem. React, Vue, Svelte, Astro,...

We scanned top npm packages for dormant publishers with active publish access. Accounts inactive 5-8 years can still push code to packages installed 2.6 billion

37 npm packages infected with Rust-based malware that hides behind an eBPF rootkit, talks over Tor, and self-propagates through npm Trusted Publishing. The comm

Run npm audit on any Node.js project and you'll get one of two things: a clean bill of health, or a...

drizzle-kit has 8.2 million weekly downloads, 4 npm publishers, provenance enabled, and a behavioral...

Originally posted on getcommit.dev. In October 2021, ua-parser-js was used by Facebook, Microsoft,...

Two npm supply chain attacks hit the same week. One was predictable. One wasn't. That's the...

When the LiteLLM supply chain attack hit in March 2026, npm audit ran clean. There was nothing to...

Same tool, same methodology, four ecosystems. 5.2 billion weekly downloads across npm, PyPI, and Cargo share a single structural weakness. Go doesn't have it.

After finding publisher-concentration risk across npm, PyPI, and Cargo, Go was the first ecosystem...

Last week I shipped @agentlair/a2a-trust-audit, a small CLI that scores any A2A agent card across...

I shipped a small demo last week. A LangChain.js agent invokes two tools, an AgentLairCallbackHandler...

I scanned the 20 most-downloaded Rust crates. 11 came back CRITICAL — single crates.io owner, millions of weekly downloads. Five of those are all owned by the s

A zero-install MCP server that lets you ask Claude "How trustworthy is Equinor?" Verified data from Brønnøysund, D&B, and supply chain signals.

A practical tutorial: add behavioral supply chain auditing to GitHub Actions, GitLab CI, or any CI system. Copy-paste YAML included.

The five behavioral dimensions, the CRITICAL flag, the bulk download optimization, and real benchmark data for chalk, express, and hono. All public data. All re

AugmentCode studied AGENTS.md files across real codebases. Best result: equivalent to upgrading from Haiku to Opus. The principle is placement: structured signa

AI companies are spending $1B+ licensing content. None of it tells them whether a business is actually good. The product that would — verified outcome data — do

There's a class of services in the agent ecosystem that will tell you an agent is "registered" and...

On May 7, AWS launched AgentCore Payments in preview. Coinbase x402 plus Stripe. Agents can now...

Anthropic published something important in their model transparency reports, and it got less...

Cloudflare Agent Memory enters public beta today. It solves a real problem: agents that die between...

The signals that make trust legible are already being collected — covertly, at scale, without your consent. ZK proofs change what's possible.