How to Audit Your VS Code Extensions for Security
The GitHub breach happened through a VS Code extension. Here's how to check what you have installed and reduce your exposure in 10 minutes.
16 min readZeeshan Tofiq
Security
6 articles
Application and supply-chain security, focused on the attacks that actually reach working developers. This section covers npm postinstall scripts as an execution vector and how to audit for them, the 2026 WordPress CDN supply-chain incident and what it revealed about third-party script trust, how source maps quietly ship readable source and secrets to production, and how to audit a VS Code extension before installing it. There is also a full tutorial on building a supply-chain scanner from scratch. The emphasis is on reproducible detection: every article shows the scan or command you can run against your own project today.
GitHub Actions Security: 7 Misconfigurations to Avoid
The 7 GitHub Actions misconfigurations behind real supply chain attacks: weak GITHUB_TOKEN scope, pull_request_target, unpinned actions, script injection.
11 min readZeeshan Tofiq
WordPress CDN Supply Chain Attack 2026: What Happened and How to Check Your Site
The OptinMonster, TrustPulse, and PushEngage supply chain attack (June 2026) hit 1.2M sites. Here's exactly how it worked, how to check if you were compromised, and how to recover.
16 min readZeeshan Tofiq
Bumblebee Tutorial: Scan Your Dev Machine for Supply Chain Risks
How to install and use Bumblebee, Perplexity's open-source scanner for npm, MCP configs, and extensions. Real commands, scan profiles, and incident response setup.
24 min readZeeshan Tofiq
Source Maps Are Leaking Your Code: How to Stop It in Your npm Packages
Source maps with sourcesContent can leak your entire codebase. Learn how to disable them per bundler, audit with npm pack, and automate the check in CI.
17 min readZeeshan Tofiq
npm postinstall Attacks: How They Work in 2026
How npm postinstall hook attacks like Shai-Hulud actually work in 2026, and a practical checklist to protect your projects and CI/CD pipeline.
14 min readZeeshan Tofiq