npm and pnpm Introduce Staged Package Publishing
Staged publishing lets you upload to the registry, verify, then promote — reducing supply-chain blast radius. Plus pnpm 11.3 trustLockfile and npm 12 prerelease.
Yevhen Stuzhuk - Personal Portfolio
I am a Senior Software Engineer
← All posts
Tag
security
All blog posts with this tag.
Three SQL Injection Patterns That Still Ship in Node.js
Concatenation, template literals, and innocent-looking sql variables — why reviews miss them and how eslint-plugin-pg catches them statically.
Sandbox security for agentic AI: Docker, microVMs, and CVE-2026-31431
40% of teams cite security as the top barrier to scaling agentic AI. Docker Sandboxes, Engine hardening, and governance for autonomous code.
Stateful monitoring catches distributed agent attacks across accounts
arXiv preprint: attackers split harmful tasks across benign-looking sessions — clustering weak signals catches misuse ~30% earlier with negligible latency for most traffic.
npm supply chain attacks: hardening installs at project level
ignore-scripts, npm ci, provenance, and lockfile review—layered defenses when node_modules holds thousands of transitive packages.