Record · corpus.blog/posts/01a08755-6ceb-722c-901b-fde098925d1e

Newsletter #013: Large Phishing Operations Against Maintainers 🎯

blog.ulisesgascon.com · published 7 April 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at blog.ulisesgascon.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 92
Words captured: 2,220

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/sponsors/UlisesGascon

github.com

Newsletter #012: New Node.js Release Schedule, AI Stress-Testing Security & CVE Season 🔐 Read at the source ↗

blog.ulisesgascon.com

https://github.com/axios/axios/issues/10636

github.com

https://socket.dev/blog/attackers-hunting-high-impact-nodejs-maintainers

socket.dev

https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package

cloud.google.com

https://www.youtube.com/watch?v=aoag03mSuXQ

youtube.com

https://socket.dev/blog/axios-maintainer-confirms-social-engineering-behind-npm-compromise

socket.dev

https://github.com/openjs-foundation/security-wg

github.com

https://socket.dev

socket.dev

https://github.com/ossf/scorecard/pull/4952

github.com

https://baseline.openssf.org/

baseline.openssf.org

https://github.com/ossf/scorecard/pull/4994

github.com

https://github.com/ossf/scorecard-monitor

github.com

https://github.com/ossf/scorecard-visualizer

github.com

https://www.youtube.com/watch?v=rqmTDVdnMT8

youtube.com

https://www.youtube.com/watch?v=k8_3VILll7c

youtube.com

https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13

github.com

https://github.com/pillarjs/hbs/releases/tag/v4.2.1

github.com

Express: March 2026 Security Releases Read at the source ↗

expressjs.com

https://www.cve.org/CVERecord?id=CVE-2026-2229

cve.org

https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8

github.com

https://www.cve.org/CVERecord?id=CVE-2026-1526

cve.org

https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q

github.com

https://www.cve.org/CVERecord?id=CVE-2026-1527

cve.org

https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq

github.com

https://www.cve.org/CVERecord?id=CVE-2026-1528

cve.org

https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj

github.com

https://www.cve.org/CVERecord?id=CVE-2026-1525

cve.org

https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm

github.com

https://www.cve.org/CVERecord?id=CVE-2026-2581

cve.org

https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h

github.com

https://www.cve.org/CVERecord?id=CVE-2026-3635

cve.org

https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf

github.com

https://www.cve.org/CVERecord?id=CVE-2026-4867

cve.org

https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2

github.com

https://www.cve.org/CVERecord?id=CVE-2026-4926

cve.org

https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f

github.com

https://www.cve.org/CVERecord?id=CVE-2026-4923

cve.org

https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7

github.com

https://www.cve.org/CVERecord?id=CVE-2026-4800

cve.org

https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc

github.com

https://www.cve.org/CVERecord?id=CVE-2026-2950

cve.org

https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh

github.com

Security Bug Bounty Program Paused Due to Loss of Funding Read at the source ↗

nodejs.org

https://docs.hackerone.com/en/articles/8496298-internet-bug-bounty

docs.hackerone.com

New HackerOne Signal Requirement for Vulnerability Reports Read at the source ↗

nodejs.org

https://github.com/nodejs/security-wg/issues/1554

github.com

Evolving the Node.js Release Schedule Read at the source ↗

nodejs.org

https://socket.dev/blog/tc39-advances-temporal-to-stage-4

socket.dev

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Temporal

developer.mozilla.org

https://socket.dev/blog/inside-lodash-security-reset

socket.dev

https://github.com/lodash/lodash/issues/6106

github.com

https://github.com/UlisesGascon/ulisesgascon/blob/main/npm-ecosystem-impact.md

github.com

https://github.com/expressjs/session/pull/1114

github.com

https://openjsf.org/blog/burnout-is-real-for-open-source-maintainers

openjsf.org

https://github.com/jdalton

github.com

https://youtu.be/ZbWx6sdhq7I?si=S-AzusGd7_98iqjs&t=1467

youtu.be

https://github.com/ljharb

github.com

https://www.youtube.com/watch?v=3u_Wb6mOa-g

youtube.com

https://t3chfest.es/2026/en/

t3chfest.es

https://www.youtube.com/@T3chFest/videos

youtube.com

https://speaking.ulisesgascon.com/techfest2018-scraping-epico-para-gente-sin-apis

speaking.ulisesgascon.com

https://speaking.ulisesgascon.com/techfest2018-airemad-y-el-open-source

speaking.ulisesgascon.com

https://www.linkedin.com/in/rginn206/

linkedin.com

https://openjsf.org/blog/rsac-2026-robin-bender-ginn

openjsf.org

https://www.youtube.com/watch?v=j2-mrQDJ_Sk

youtube.com

https://www.nasa.gov/news-release/nasas-artemis-ii-crew-eclipses-record-for-farthest-human-spaceflight/

nasa.gov

https://github.com/pmatos

github.com

https://github.com/pmatos/jsse

github.com

JSSE: A JavaScript Engine Built by an Agent Read at the source ↗

p.ocmatos.com

https://ccusage.com/guide/installation

ccusage.com

https://github.com/UlisesGascon/lodash-benchmarks

github.com

https://www.linkedin.com/in/javier-saez-gallego/

linkedin.com

https://www.geofiles.cloud/

geofiles.cloud

https://github.com/sethmlarson

github.com

https://github.com/miketheman

github.com

Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance Read at the source ↗

blog.pypi.org

PyPI in 2025: A Year in Review Read at the source ↗

blog.pypi.org

https://github.com/voxpelli

github.com

https://gist.github.com/voxpelli/d68fcc2c6300b662daa93fbf0af3a526

gist.github.com

https://bsky.app/profile/voxpelli.com/post/3mh76o7xstc2s

bsky.app

https://bsky.app/profile/voxpelli.com/post/3mieyeb5wtc2t

bsky.app

https://x.com/elsatch

x.com

https://www.lahoramaker.com/

lahoramaker.com

https://www.youtube.com/watch?v=d6moRNMK5ik

youtube.com

https://github.com/joyeecheung

github.com

Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8 Read at the source ↗

nodejs.org

https://www.cve.org/CVERecord?id=CVE-2026-21717

cve.org

Open Source Has a Bot Problem Read at the source ↗

glama.ai

https://addyosmani.com/blog/comprehension-debt/

addyosmani.com

https://blog.jimmyvo.com/posts/claude-coworks-virtualization/

blog.jimmyvo.com

https://ayende.com/blog/203907-B/the-million-ai-monkeys-hypothesis-real-world-projects

ayende.com