Skip to main content

Blog

Thoughts & Stories

Sharing my experiences, learnings, and adventures in tech and beyond.

Browse by Topic

DevOps & Cloud Infrastructure (193)AI & LLMs (143)Backend & APIs (102)Web Development (90)ERP Systems (77)Security (65)Software Development (58)Career Reflections (29)Cloud (29)AI / Machine Learning (18)Product & SaaS (12)University (1)Hackathons (1)
npm Trusted Publishing: 48-Hour Expiry and issue_comment Ban
DevOpsOctober 202611 min read

npm Trusted Publishing: 48-Hour Expiry and issue_comment Ban

npm now expires unvalidated trusted publishing configurations after 48 hours and rejects issue_comment tokens. Here is what changed and how to migrate a release workflow.

Read More
Hijacked AI Coding Assistant Session Spread Shai-Hulud Worm
SecurityOctober 202611 min read

Hijacked AI Coding Assistant Session Spread Shai-Hulud Worm

Mandiant says a hijacked AI coding assistant session led to a poisoned PyPI package, stolen GitHub tokens and a worm in about 100 repos. What is known, and the defences.

Read More
npm Worm With Valid SLSA Provenance: The keyv Lesson
SecurityOctober 202612 min read

npm Worm With Valid SLSA Provenance: The keyv Lesson

The keyv npm worm shipped through GitHub Actions and OIDC with valid provenance. What provenance proves, what it cannot, and which gates to add instead.

Read More
kubectl-ai Guide: Confirmation Gate, Limits and MCP Server Risk
DevOpsOctober 202612 min read

kubectl-ai Guide: Confirmation Gate, Limits and MCP Server Risk

kubectl-ai read from its source: how the confirmation gate classifies commands, what quiet mode and maxIterations do, and why the MCP HTTP server needs OAuth.

Read More
EU AI Act Digital Omnibus Deadlines: A DevOps Team Calendar
SecurityOctober 202612 min read

EU AI Act Digital Omnibus Deadlines: A DevOps Team Calendar

Regulation (EU) 2026/1744 moved AI Act high-risk dates to Dec 2027 and Aug 2028, but Article 50 and two Dec 2026 deadlines still apply. A DevOps calendar.

Read More
Tensorlake npm Shai-Hulud Compromise: Lock Down Install Scripts
SecurityOctober 202612 min read

Tensorlake npm Shai-Hulud Compromise: Lock Down Install Scripts

A Shai-Hulud variant hit the Tensorlake npm SDK through a preinstall hook and the project's own release workflow. What it took, and how to block it.

Read More

Showing 49–54 of 818 posts

Explore More

Projects

See the projects I've built

Experience

My professional career

Certifications

Professional certifications