Skip to main content

Vol. MMXXVI No. 102

Field reports from cloud-security engineering, AI experiments, and a homelab that keeps getting bigger.

Front page: latest writing from William Zujkowski

Start here: agentic security, tools, and homelab reading paths

Supply Chain 9 min read

The Override Was Still in package.json

A one-line pnpm override kept this site off a vulnerable fflate. Dependabot’s lockfiles lost it in two ways, and only one of them failed the build.

  1. Supply Chain 8 min read

    The Repository Link That Points at Nobody

    About one declared repository link in seven no longer cloned anonymously, and for about a fifth of those the GitHub account it names no longer existed.

  2. DevOps 9 min read

    Plant the Defect, Watch the Gate

    Mutation testing pointed at CI checks instead of code: plant a known defect, require the gate to go red, and put a floor under how much it examined.

  3. Supply Chain 9 min read

    Provenance Attests the Pipeline, Not the Intent

    Three 2026 npm compromises shipped malware with valid provenance. Only one of them is visible in the signed fields, and a fourth shows what provenance does catch.

  4. Linux 10 min read

    The Command Said It Worked

    Five commands this site published reported success while doing nothing. A small container lab reproduces four, and the cheap defense is running each command once where it must fail.

  5. Software Engineering 5 min read

    One ZIP, Two Lists of Files

    A small reproducible ZIP lab shows why indexed and streaming readers can inspect different entries in the same archive.