How to Audit Your VS Code Extensions for Security
The GitHub breach happened through a VS Code extension. Here's how to check what you have installed and reduce your exposure in 10 minutes.
11 min readZeeshan Tofiq
Security
6 articles
GitHub Actions Security: 7 Misconfigurations to Avoid
The 7 GitHub Actions misconfigurations behind real supply chain attacks: weak GITHUB_TOKEN scope, pull_request_target, unpinned actions, script injection.
14 min readZeeshan Tofiq
WordPress CDN Supply Chain Attack 2026: What Happened and How to Check Your Site
The OptinMonster, TrustPulse, and PushEngage supply chain attack (June 2026) hit 1.2M sites. Here's exactly how it worked, how to check if you were compromised, and how to recover.
12 min readZeeshan Tofiq
Bumblebee Tutorial: Scan Your Dev Machine for Supply Chain Risks
How to install and use Bumblebee, Perplexity's open-source scanner for npm, MCP configs, and extensions. Real commands, scan profiles, and incident response setup.
11 min readZeeshan Tofiq
Source Maps Are Leaking Your Code: How to Stop It in Your npm Packages
Source maps with sourcesContent can leak your entire codebase. Learn how to disable them per bundler, audit with npm pack, and automate the check in CI.
11 min readZeeshan Tofiq
npm postinstall Attacks: How They Work in 2026
How npm postinstall hook attacks like Shai-Hulud actually work in 2026, and a practical checklist to protect your projects and CI/CD pipeline.
10 min readZeeshan Tofiq