# Security — Daine Mawer

> Supply chain risk, dependency trust, and the vulnerabilities that actually reach production.

1 article filed under Security.

## Articles

- [Shai-Hulud Broke npm's Trust Model. Here's the Replacement](https://www.dainemawer.com/npm-supply-chain-trusted-publishing.md):
  Published 2026-09-30. 6 min read. A self-replicating worm hit 500+ packages by stealing publish tokens. npm's fix removes the tokens instead of trusting them harder.

---

Canonical HTML: https://www.dainemawer.com/topics/security
Markdown index: https://www.dainemawer.com/index.md · Agent guide: https://www.dainemawer.com/agents.md · [llms.txt](https://www.dainemawer.com/llms.txt)
Attribution: Daine Mawer — https://www.dainemawer.com/about