Record · corpus.blog/posts/01a0da1f-2ec5-7160-9bd9-9c502cbd4eae

Unfinished Work in Package Security

Andrew Nesbitt | Software Engineer and Package Management Nerd · published 22 September 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at nesbitt.io Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 28
Words captured: 1,897

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

Postmortem: Nx Console v18.95.0 supply-chain compromise Read at the source ↗

nx.dev

https://nx.dev/blog/s1ngularity-postmortem

nx.dev

https://pip.pypa.io/en/stable/reference/build-system/

pip.pypa.io

https://getcomposer.org/doc/06-config.md

getcomposer.org

https://www.ledger.com/blog/security-incident-report

ledger.com

https://www.debian.org/devel/testing

debian.org

GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 4/2) Read at the source ↗

unit42.paloaltonetworks.com

https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/

blog.pypi.org

https://www.openwall.com/lists/oss-security/2024/03/29/4

openwall.com

https://go.dev/blog/rebuild

go.dev

https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident

blog.npmjs.org

https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html

python-security.readthedocs.io

https://blog.packagist.com/packagist-org-maintainer-account-takeover/

blog.packagist.com

https://jqwik.net/docs/1.10.1/user-guide.html

jqwik.net

Breaking Claude Code Opus 5 Auto Mode Read at the source ↗

embracethered.com

https://blog.packagist.com/composer-command-injection-vulnerability/

blog.packagist.com

https://blog.packagist.com/cve-2022-24828-composer-command-injection-vulnerability/

blog.packagist.com

https://github.com/advisories/GHSA-mq26-g339-26xf

github.com

https://pkg.go.dev/vuln/GO-2026-4338

pkg.go.dev

The Missing Bundler Features Read at the source ↗

byroot.github.io

How to report a security vulnerability, 101 Read at the source ↗

isc.org

https://docs.djangoproject.com/en/dev/internals/security/

docs.djangoproject.com

10K curl downloads per year Read at the source ↗

daniel.haxx.se

https://bugs.ruby-lang.org/issues/20516

bugs.ruby-lang.org

https://github.com/dotnet/announcements/issues/315

github.com

https://www.enisa.europa.eu/sites/default/files/2026-03/ENISA%20Technical%20Advisory%20-%20Package_Managers_Final.pdf

enisa.europa.eu

https://spdx.github.io/spdx-spec/v2.3/package-information/

spdx.github.io

https://fosdem.org/2026/schedule/event/PTHENV-sustaining-foss-with-attestations/

fosdem.org