Engineering essays from the bench.
War stories, architecture decisions, and the occasional tirade. Written by the engineers who shipped it.
Opening a Repo Is Running Code: GitSpawn and Coding Agents
GitSpawn and Plugin4Shell showed coding agents running repo-supplied code before any prompt. Patch status, a pre-open check script, and fixes for builders.
Your AI Gateway Is the New Crown Jewel: LiteLLM's 2026
LiteLLM's poisoned PyPI releases, a pre-auth SQL injection and an MCP command injection, both in CISA KEV. What to check, rotate and lock down.
Your CI Runner Is the Target: The TanStack and AntV npm Attacks
TanStack packages shipped with valid provenance from a poisoned CI cache. What the May 2026 npm attacks mean for your GitHub Actions setup.
Axios npm Supply Chain Attack: How It Works and How to Respond
How the March 2026 Axios npm attack compromised a 100M-download package to deploy a cross-platform RAT, plus detection and remediation steps.
Supply Chain Predictive Analytics: A Practical Build Guide
How to build predictive analytics for a supply chain: censored demand data, forecast baselines, quantile models, reorder points and policy backtests.
Software Supply Chain Security: A Practical Defense Guide
Secure your software supply chain: lockfiles, install-script limits, release cooldowns, hardened CI, SBOMs, signed provenance and an incident playbook.
