Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Scan a Python project, upgrade the flagged package with pip, pip-tools, Poetry or uv, approve each step, then test and rescan with the Safeguard CLI.
Scan the lockfile, trace where each vulnerable package comes from, upgrade or override it with approvals, run npm ci and tests, then rescan to confirm.
Find vulnerable Java libraries, pin safe versions with Maven dependencyManagement or Gradle constraints, approve each step, test and rescan with the CLI.
Scan your Go module with the Safeguard CLI, upgrade the affected module with go get, tidy and test with your approval, then rescan before you commit.
Malware records usually list the exact versions someone analysed, and scanners match only those. 2026 OSV data for PyPI and npm, the leakdeep credential stealer whose version 2.6.2 isn't in its record, and a script that checks lockfiles by package name.
Free, no login tools a maintainer can use: Gold package and CVE pages, the in-browser scan, a CLI gate through the Gold scan package, and local scans before a release.
On 9 September 2026 npm extended a 72 hour security hold to every account that signs in with a recovery code, targeting the email change, new token, malicious publish pattern.
GitHub added a cache-mode setting on 10 September 2026 to limit who can write to the Actions cache. Socket ties it to the TanStack npm compromise and other cache poisoning cases.
Socket reported theme extensions on the VS Code Marketplace and Open VSX, two confirmed malicious, with a Solana dead drop for the next stage. Many cluster members are not confirmed.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
