Blog
Supply chain security, explained
Technical deep dives on npm attacks, detection techniques, and dependency risk management.
Dependency Guardian vs Socket.dev: An Honest Comparison (2026)
Socket has $65M and big-name customers. Dependency Guardian has published accuracy data on a 17,874-package disclosed-malware corpus and costs 5x less at scale. Here's where each tool wins.
Axios Supply Chain Attack (March 2026): How Behavioral Scanning Caught the RAT CVE Scanners Missed
The Axios npm compromise put a RAT in 100M weekly downloads. npm audit, Snyk, and Dependabot all passed clean. Here's what behavioral scanning catches that they can't.
How Dependency Guardian Catches the Shai-Hulud npm Worm
The Shai-Hulud worm turned one preinstall hook into 796 compromised packages in 72 hours. CVE scanners returned 0 vulnerabilities on every one of them. Behavioral scanning catches it before the first credential is stolen.
npm postinstall Scripts: The Security Risk Nobody Reviews
Every npm install runs arbitrary code from hundreds of packages via postinstall hooks. The biggest supply chain attacks all exploited this. Here's what they look like and how to catch them.
Behavioral npm Security Scanning: The Complete Guide (2026)
CVE-based scanners miss every supply chain attack during the window that matters. This guide explains what behavioral npm scanning is, how it works, and what it catches that advisory databases structurally cannot.
Why npm audit and Snyk Miss 100% of Supply Chain Attacks
npm audit checks advisory databases. Supply chain attacks don't have advisories. Every major npm attack last year passed these tools clean while it was live.
Fishing for Malware: Catching a Trojanized AI Tool Hiding in npm
Dependency Guardian flagged a trojanized AI coding assistant two minutes after it was published to npm. 73 out of 76 antivirus engines missed it. Here's what was inside and why behavioral scanning caught it.
Start scanning your dependencies
Behavioral detection for npm supply chain attacks. Free tier, no credit card.
Sign UpFree tier available. No credit card required.