Explaining the csurf vulnerability: CSRF attacks on all versions

Best practices for creating a modern npm package

Best practices for managing Java dependencies

Snyk finds PyPi malware that steals Discord and Roblox credential and payment info

A bit meta and high-level, but overall best practices for creating secure webhooks article on Snyk blog

5 ways to prevent code injection in JavaScript and Node.js, an article I wrote on the Snyk blog

The Ultimate Guide to Python Pickle

Spring4Shell: The zero-day RCE in the Spring Framework explained

NPM package compromised by author: erases files on RU / BY computers on install

The Big Fix: Fix Vulnerabilities, Get a Shirt

Open source maintainer pulls the plug on NPM packages colors and faker, now what

Log4j used indirectly in 60+% of java projects it's utilized, per Snyk data

Log4Shell Remediation Cheat Sheet | Created by Java Champion and security researcher at Snyk

JVM Ecosystem Report 2021

Supply chain security vulnerabilities in Visual Studio Code extensions

Security concerns of third-party JavaScript scripts | Snyk Blog

Finally, a curation of 10 React security best practices

Why npm lockfiles can be a security blindspot for injecting malicious modules

Operation SourMint – Malicious SDK Ad fraud affects 1,200 apps on Apple AppStore

Vuln Cost - security scanner for VS Code

Angular security best practices

How to crash an email server with a single email (2018)

Show HN: Vuln Cost – immersive VS Code extension to surface vulnerabilities

What is a backdoor? Let’s build one with Node.js

Kotlin overtakes Scala and Clojure as 2nd most popular language on the JVM

36% of developers switched from Oracle JDK to an alternate OpenJDK distribution, over the last year

JVM Ecosystem Report 2020

Node.js release fixes a critical HTTP security vulnerability

Understand filesystem takeover vulnerabilities in NPM JavaScript package manager

NPM lockfiles can be a security blindspot for injecting malicious modules in PRs

More →