Writing

• 2026-11-06 What the npm registry remembers

  Removed npm releases leave a lot behind. Rebuilding the axios, easy-day-js and qix compromises from registry metadata alone, and turning that into a detector.

• 2026-11-02 A raw TCP backdoor behind the cleverstack git hook lure

  Two files tagged BeaverTail turn out to be a Node.js backdoor that skips HTTP and Socket.IO and talks newline-delimited JSON over plain TCP. Protocol, delivery chain, detections.