Supply-Chain-Security on krash.dev

Before Your Code Runs: Node.js

Sun, 29 Mar 2026 00:00:00 +0000

This post is part of the Before Your Code Runs series, cataloguing the hidden, implicit code execution surfaces in programming language runtimes and toolchains.

Node.js and npm sit underneath a huge chunk of the modern web. It’s the runtime that made JavaScript a “real” backend language, and npm is the largest package registry in the world. That’s a lot of trust in a lot of code.

Here’s roughly what happens when Node starts:

Before Your Code Runs: Python

Sun, 29 Mar 2026 00:00:00 +0000

This post is part of the Before Your Code Runs series, cataloguing the hidden, implicit code execution surfaces in programming language runtimes and toolchains.

Python is probably the most beloved language in the world right now. It’s everywhere: data science, web backends, DevOps glue, AI/ML pipelines, you name it. And because it’s everywhere, attackers love it too. The thing is, most Python developers think execution starts when you type python app.py. It doesn’t. Not even close.

Reputation Farming in OSS: A Threat to Building Trust

Thu, 27 Jun 2024 00:00:00 +0000

This issue complicates the open source and supply chain security space. For attacks like xz, such strategies can be used by attackers to build “fake” trust among fellow OSS community members.

A few days ago, this discussion ignited in the OSSF Slack, which talked about the issue of credibility farming in several open source repositories.

So, the issue revolves around GitHub (or equivalent platforms) accounts approving or commenting on old pull requests and issues that were already resolved or closed, where these meaningless contributions show up prominently on the user’s profile and activity feed, making their involvement seem more significant than it actually is, without closer look.

Two Bits on the xz Vulnerability

Mon, 01 Apr 2024 00:00:00 +0000


GitHub Repository	xz (Suspended)
Source Code	https://git.tukaani.org/?p=xz.git
Threat Actor	Jia Tan (GitHub)
CVE Number	CVE-2024-3094 (CVSS 10.0)
Vulnerability Type	Remote Code Execution
Attack Category	Social Engineering, Supply Chain Attack

What does `xz` module do?#

XZ Utils is a set of free and open-source data compression utilities that provide high compression ratios and fast decompression. It primarily uses the LZMA compression algorithm , which is an algorithm for lossless data compression.

Handling Deprecated Dependencies In Your Project

Tue, 07 Nov 2023 00:00:00 +0000

Disclaimer: Just a heads up, while we’re diving into ways to tackle the problem of dependency depreciation, there’s no one-size-fits-all solution here. It’s a bit of a wild ride dealing with supply chain security and those pesky deprecated dependencies, so don’t expect a quick fix!

The issue of using deprecated dependencies has persisted for quite some time, and it’s gaining increased attention. Many projects continue to incorporate deprecated dependencies.

I was inspired to write this blog after coming across a LinkedIn post by Rory McCune and several other posts over the past few weeks.

VS Code Security: Looking at the IDE from Security Lens

Thu, 14 Sep 2023 00:00:00 +0000

While perusing StackOverflow's 2023 Developer Survey (yes, we developers have our own version of celebrity gossip), I couldn’t help but notice that our trusty VSCode is still riding high as the undisputed IDE champ. With a whopping 73% of the developer vote, it’s safe to say that VSCode has firmly planted its flag. But, like any superstar, it’s not immune to the spotlight’s glare, especially when it comes to security. And in this blog, we’ll explore the security aspects that every VSCode user should consider.