PackageFix Blog — Dependency Security Guides
Supply chain security, CVE analysis, and dependency management guides for developers.
Supply Chain Security
5 Supply Chain Attacks Hiding in Your package.json
npm audit misses Glassworm Unicode injection, zombie packages, typosquatting, build script injection, and CISA KEV entries. Here's what to look for.
Weekly CVE Digest
Weekly CVE Digest — March 2026
This week's most critical CVEs across npm, PyPI, Ruby, PHP, Go, Rust, and Java. Log4Shell still being exploited. New HTTP/2 rapid reset variants.
CVE Reference Pages
Dedicated pages for the highest-impact CVEs — with fix guides for every affected ecosystem.