Blog
Insights from the StackRadar team
Supply chain security, dependency management, and engineering practices.
The Cyber Resilience Act: What Software Teams Need to Know
The EU Cyber Resilience Act introduces mandatory security requirements for products with digital elements — including software dependencies. Here is what changes, when, and how to get ready.
Axios CVE-2023-45857: How a Single Bug Exposed Millions of Users
A subtle flaw in Axios — the most popular HTTP client in JavaScript — meant that browser apps were quietly leaking CSRF protection tokens to third-party servers. Here is what went wrong and why it affected so many teams.
The XZ Utils Backdoor: A Two-Year Attack That Almost Broke SSH
In early 2024, a mysterious contributor was revealed to have spent over two years infiltrating an open-source compression library — and nearly inserted a backdoor that would have let anyone log into millions of Linux servers without a password.
node-ipc: The npm Package That Deleted Your Files Based on Where You Lived
In March 2022, the author of a package with 11 million weekly downloads shipped an update that wiped files on computers in Russia and Belarus. Here is what happened and what it revealed about open-source trust.
event-stream: How a Malicious npm Package Stole Crypto for Six Weeks
In 2018, a new maintainer took over one of npm's most popular packages and quietly injected code to steal bitcoin from a specific wallet app. It ran undetected for six weeks — and was discovered entirely by accident.
Supply Chain Attacks Explained: When the Package Is the Threat
You review your code. You audit your PRs. But what about the 70+ packages your project pulls in automatically? Supply chain attacks target the software you build with, not the software you write.
Log4Shell: The Vulnerability That Was Hiding in Half the Internet
In December 2021, a critical flaw in Log4j — a Java logging library embedded in billions of devices — gave attackers remote code execution on almost any internet-facing server. Here is what happened and why patching it was a crisis of its own.