Category
5 posts in this category.
Security research
When LLMs hallucinate plausible-sounding package names, attackers register those names and publish stubs with malicious payloads. The inverse of typosquatting — the model produced the name, not the developer.
Security research
PyPI typosquats follow a small set of recurring patterns: transposition, omission, hyphenation variants, prefix and suffix insertion, abandoned-name resurrection. Here is the catalog and what each pattern looks like in the wild.
Security research
A research note on detection latency for malicious npm packages: median windows of hours for high-profile cases, days-to-weeks for the long tail, with the data caveats. The implication for defense planning is structural.
Security research
A taxonomy of the vectors observed across documented npm and PyPI account-takeover incidents: phishing, credential reuse, expired domains, session-token theft, OAuth grants, and social-engineered handoffs. Each with what mitigates it.
Security research
The cooling-period idea — refuse to install brand-new versions until they have been published long enough and observed enough — has a long history in academic literature. Here are the threads of research and why two thresholds beat one.