Catch typosquats and dependency confusion in CI (for free)
Most "dependency scanners" only tell you about known CVEs. But a huge class of real supply-chain attacks has no CVE at all: typosquatting (publishing expresss to catch people who fat-finger express) and dependency confusion (publishing a public package with your internal name so it gets installed instead). Trivy, Grype and Dependabot won't flag these — there's no advisory to match. By the time there is one, the malicious postinstall has already run in your CI. A name that's a single edit away fr
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.