CI/CD

Dependency Confusion: Your Internal Package Name Is a Public Attack Surface

Publish a package with the same name as a company's private one, give it a higher version number, and package managers will happily install the attacker's code instead. Here's how it still works in 2026.

Cordyceps and GitHub Actions: When CI/CD Trust Boundaries Become the Supply Chain Attack

Novee's Cordyceps research is a reminder that GitHub Actions workflows are executable attack surface, not harmless YAML. Here is how to audit the trust boundary before an outside pull request borrows maintainer authority.