By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

The Cloud-Native Digest is a monthly roundup on all things cloud native, artifact management, and supply chain security from Cloudsmith's Head of Developer Relations, Nigel Douglas.

Welcome to the July 2026 edition. In this issue, we’re tackling the real-world realities of modern software defense, from why high vulnerability scores can misrepresent actual risk of exploitation to the ways that AI agents are escaping existing sandbox boundaries, as seen with the Hugging Face and OpenAI fallout. Plus, we break down critical supply chain stories across 

. Let’s jump straight into the analysis.

Supply Chain Security in the Month of July

Why higher CVSS vulnerabilities aren't always the most exploited
Date: 

July 1st 2026

The Sysdig Threat Research Team observed the first known in-the-wild exploitation of 

, a CVSS 9.9 IDOR-style vulnerability in Langflow, alongside 

, a lower-scored (CVSS 9.3) unauthenticated RCE. Despite the IDOR's higher CVSS score, opportunistic threat actors heavily favour the RCE because it provides immediate host execution with minimal effort, whereas the IDOR requires enumerating flow UUIDs and is harder to weaponise. Ultimately, the findings illustrate the effort-to-yield paradox whereby CVSS scores do not always reflect real-world exploitation risk, though the IDOR poses a severe threat in multi-tenant environments where host-level RCE is sandboxed.



https://www.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited

When upgrading is the wrong answer to a CVE
Date:

 July 22nd, 2026

While security standards mandate keeping dependencies up to date, relying solely on upgrading to fix vulnerabilities has become a flawed approach. Upgrading often fails because a fix may not exist yet, an abandoned package will never receive one, a new version introduces breaking changes, or the latest release contains malicious code from a compromised maintainer. These factors are compounded by AI tools that enable attackers to quickly chain minor vulnerabilities into major exploits; traditional scanning and upgrading can no longer keep up. Instead of risking broken builds or undertaking costly migrations, a better path is directly patching the specific vulnerability within the existing, trusted version of a package.



https://www.aikido.dev/blog/cve-upgrade-breaking-changes-open-source

Why is it so hard to configure time in cooldown logic?
Date:

 July 17th, 2026

Client-side cooldown policies which protect software supply chains by holding new packages for threat screening are heavily fragmented across language ecosystems. These policy controls often use inconsistent time formats (such as seconds, minutes, days, or ISO 8601 strings) or lack native support entirely (like Go and NuGet). Managing these conflicting client-side configs creates friction for security teams. The idea of centralised cooldown controls through a single platform like Cloudsmith eliminates this complexity by enforcing uniform security policies across all package formats from a single control plane, using a single interpretation of time.



https://cloudsmith.com/blog/how-to-configure-time-for-cooldown-policies

What’s the deal with the AsyncAPI npm supply chain attack?
Date:

 July 14th, 2026

Attackers exploited a misconfigured GitHub Actions workflow in the AsyncAPI project to steal automation tokens and release trojanised 

). Executing upon package import rather than on-install, the malicious payload harvested developer and CI/CD secrets. It bypasses traditional security scanners by leveraging legitimate release pipelines and clean initial advisory feeds. Organisations should check lock files for affected versions (such as 

), immediately rotate exposed tokens, and consider using private registry proxies with package cooldown policies to block future zero-hour supply chain risks.



https://cloudsmith.com/blog/inside-the-asyncapi-npm-supply-chain-attack

Cybersecurity startup publishes infostealers to NPM
Source:



The founder of an Israeli cybersecurity startup was found to have published at least seven typosquatted packages to JavaScript’s 

 registry, primarily impersonating popular AI developer tools like Anthropic, LangChain, and OpenAI. They functioned as quiet infostealers. By abusing automatic 

 execution scripts, the packages harvested detailed env & dev identity fingerprints (such as Git reflogs, hostnames, SSH key comments, and cloud account metadata) while explicitly avoiding direct credential theft to evade detection.



Signed, attested, and malicious: Your SSC has a deepfake problem
Source:



Software supply chain attacks have evolved into deepfakes. Attackers compromise 

 maintainer credentials and to publish malware that carries legitimate signatures, provenance, and attestations. Incidents like the Miasma worm in 

 registry demonstrate that security scanners can no longer rely on trust signals alone, as poisoned packages now appear indistinguishable from routine updates. Because technical verification mechanisms are functioning as designed rather than failing, security must shift toward behavioural analysis to evaluate what a package actually does before it reaches the dev's machine.



Next.js moves to scheduled security releases
Source:



Next.js is formalising a predictable, monthly security release program to provide advance notice and mitigate potential exploits, replacing its previous ad-hoc patching approach. The first scheduled security release came out on the 21st of July. This update delivered patch updates for Next.js versions 

 covering 9 total vulnerabilities (4 high and 5 medium severity).



Finding 8 high-severity vulnerabilities in NodeBB in 6 hours
Source:



Aikido Security used its AI-powered pentesting platform to discover eight high-severity vulnerabilities in NodeBB in under six hours. The findings included multiple cross-site scripting vectors, admin authorisation bypasses, user impersonation, mass assignment, and unauthenticated data leakage. Aikido reported the security flaws to the NodeBB maintainers, who patched all identified issues in version 

Untangling crates.io accounts from GitHub
Source:

, crates.io is decoupling its account system from GitHub by introducing native crates.io 

, laying the foundation to support alternative identity providers in the future. This shift provides significant benefits to the Rust community by offering devs greater control over their package-registry identity without tying it directly to a single platform. Beyond increasing flexibility, supporting additional login options makes the ecosystem more accessible to developers and organisations that don't use GitHub, while also reducing the risk of maintainers getting locked out of managing their crates due to single-platform outages, suspensions, or policy changes.



Announcing Topcoat: a framework for building full-stack react web apps with Rust
Source:

 is a modular, full-stack Rust web framework designed to simplify building reactive applications through server-side rendering without relying on WASM. It achieves client-side reactivity by rendering HTML on the server and embedding metadata or cross-compiling subset Rust expressions to JavaScript via macros. Driven by the philosophy of locality of behaviour, Topcoat features a complete asset pipeline, integrated icon/font libraries, request-level 

, and a Tailwind-based UI component system, complementing lower-level routers like Axum by eliminating typical web development boilerplate.



Battery packs: Let's talk about crates, baby!
Source:

) designed to help Rust developers quickly discover and set up curated sets of recommended crates, project templates, and GitHub Actions based on specific domains like CLI, embedded, or backend development. Rather than acting as a direct code dependency, a battery pack simply serves as an easily modifiable starting list to eliminate research fatigue for newcomers without causing vendor lock-in or ecosystem stagnation. Anyone can publish a battery pack, creating a flexible foundation that working groups can leverage to drive interoperability and pool funding for maintainers.



Unveiling RIFT: Enhancing Rust malware analysis through pattern matching
Source:

Microsoft Threat Intelligence Center (MSTIC)

, a toolset designed to automate and streamline the reverse engineering of Rust-based malware. Because Rust’s safety features, concurrency, and static linking produce unusually large binaries filled with library code, analysts often struggle to isolate a threat actor's actual code. RIFT addresses this by using pattern matching, such as compiler metadata extraction, custom FLIRT signatures, and binary diffing to identify and label third-party library dependencies automatically. By stripping away standard library clutter, RIFT significantly reduces analysis time, allowing security researchers to focus directly on malicious logic.

 proposes a public, tamper-evident transparency log operated directly by package indexes like PyPI to record artifact hashes and publisher identities. By making all publishing claims discoverable and permanent, the log prevents a compromised index from silently serving altered package files to different users, while enabling maintainers and third-party security monitors to immediately detect tampering or unauthorised releases.



Releases now reject new files after 14 days
Source:



To protect against project compromises, PyPI now rejects new file uploads to releases older than 14 days, preventing attackers from secretly poisoning stable packages. Triggered by high-profile supply chain compromises in early 2026 and backed by community consensus, the change requires maintainers to issue a new release version when adding files like new Python wheels. While formal APIs defining closed releases are coming via 

, this guardrail immediately protects Python users and keeps release histories clear and secure.



Pip 26.2: –only-deps solves 16 years of app deployment hacks
Source:

), solving a 16-year-old workaround for Python applications and scripts that do not need to be installed as packages. By allowing dev to install dependencies directly from 

 without installing the project itself, this change simplifies the app deployments and builds on the momentum driven by existing third-party tools like 

What every Python dev should know about the CPython ABI
Source:



CPython’s Application Binary Interface (ABI) defines the low-level rules, such as memory layout and exported symbols, that allow native C, C++, Rust, or Fortran extensions to interact with the Python interpreter. While a CAPI consists of source-level definitions like headers and macros, the ABI ensures compiled binaries can run correctly without link-time or runtime memory errors. Python packages use ABI compatibility tags in wheel filenames to signal whether a binary requires a specific CPython minor version (like 

) or supports the forward-compatible Stable ABI (

). The introduction of the free-threaded interpreter altered the internal PyObject layout to remove the 

). To address this, Python 3.15 introduces the 

 stable ABI, used opaque structs to allow a single compiled wheel to support both GIL-enabled and free-threaded builds across future releases.

CVE-2026-64600 - Kernel flaw lets attackers gain root access
Source:



RefluXFS is a 9-year-old Linux kernel race condition that allows local, unprivileged users to overwrite root-owned files at the block layer and gain persistent root access. The vulnerability affects systems using XFS filesystems created with 

, putting default installs of Red Hat Enterprise Linux, Fedora Server, and Amazon Linux at immediate risk. Because there are no practical 

-option workarounds, securing vulnerable hosts requires applying the vendor's backported kernel patch and rebooting the system.

CVE-2026-8933 - Ubuntu security flaw breaks Snap sandbox protections
Source:



Qualys researchers disclosed 2 high-severity local privilege escalation vulnerabilities in Ubuntu Desktop (CVE-2026-8933 & CVE-2026-3888). Both flaws affect default installs running 

. CVE-2026-8933 in particular allows unprivileged local users to gain root access by exploiting race conditions in temporary 

 directory initialisations, using FUSE mounts and symlinks to bypass AppArmor restrictions. Users should apply Canonical's latest security updates for 

CVE-2026-53359 - Lessons learned from handling a KVM flaw on tens of thousands of machines
Source:



Following the discovery of a 16-year-old use-after-free flaw in KVM x86, OVHcloud executed an urgent, 11-day emergency patching campaign across tens of thousands of hypervisors and 

. After ruling out live patching and migration at scale due to time and stability constraints, OVHcloud opted for a unilateral kernel patch and host reboot strategy to minimise the vulnerability window. Using a 24/7 follow-the-sun operational model, with anti-affinity safeguards to prevent simultaneous cluster outages, and targeted customer comms, the team successfully secured the entire fleet while containing service disruptions.



Linux kernel security faces challenge with surge in CVEs
Source:



Over a single two-day period, the Linux kernel team published 432 CVEs, overwhelming sysadmins and fueling speculation that AI-assisted bug hunting is driving a massive influx of reports. Because the kernel team assigns CVEs to nearly any bugfix affecting system availability, prioritising individual patches has become nearly impossible for security teams. Experts warn that neither manual reviews nor current LLM triage methods are equipped to handle this volume, leaving organisations forced to consider risky, frequent fleet-wide updates to keep pace with the ongoing surge - or adopt 

Kubernetes 1.37 – What you need to know
Source:



Scheduled for release next month, Kubernetes 1.37 introduces 86 total enhancements, focusing heavily on performance, cluster security, and fine-grained hardware management. Highlights include stable graduations for faster, non-recursive SELinux volume mounts and human-friendly KYAML formatting, along with new features like native per-container POSIX 

 binary data format for faster CRDs. The update also advances Dynamic Resource Allocation with standardised NUMA node attributes and device taints, while laying the groundwork to phase out 

Kubernetes Podcast episode 269: AI Policy, with Kat Cosgrove and Natali Vlatko
Source:



When people talk about AI in Kubernetes, the conversation is often focused on the user side, but for open source maintainers, there's of course a lot to unpack on how AI is changing OSS contribution! How does AI impact the community, and what are the new rules of engagement? In this session, Kat Cosgrove (SIG Docs Technical Lead, SIG Release Subproject Lead, and Kubernetes Steering Committee member) and Natali Vlatko (SIG Docs Co-Chair, TODO Group Steering Committee member, and OSPO at Cisco) unpacked the recently published Kubernetes AI usage policy for Kubernetes contributors.



Unpatched Argo CD flaw lets attackers takeover Kubernetes clusters
Source:



Synacktiv researchers used custom CodeQL analysis to discover an unauthenticated RCE vulnerability in Argo CD’s 

 component. By sending custom gRPC requests and manipulating cached entries in the internal Redis DB, an attacker could force Argo CD to deploy malicious manifests, ultimately leading to a full Kubernetes cluster takeover. The risk is heightened because standard Helm deployments leave network isolation disabled by default. In this scenario, applying strict Kubernetes network policies to restrict access to 

 appears to be the primary mitigation to this flaw.



New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
Source:



The NadMesh botnet poses a severe threat to Kubernetes environments by actively scanning exposed API servers, Kubelet endpoints, and etcd instances to execute remote code. It achieves node-level compromise through Kubernetes API exploitation by creating malicious pods with 

 mounts to escape container boundaries. Once inside, NadMesh harvests 

 ServiceAccount tokens, steals cloud and AI service creds from 

 variables, and maps internal networks for lateral movement. Check out the blog for steps to mitigate these risks.

Mitigating The Hugging Face Breach
Source:



Hugging Face and OpenAI disclosed a major security incident where an autonomous AI agent (

) broke out of OpenAI’s isolated research environment via a proxy zero-day and subsequently breached Hugging Face's production infrastructure to obtain benchmark answer keys. Rather than focusing on the AI's autonomous capability, security firm Edera highlights that both breaches succeeded due to a shared architecture flaw. This is where most of the industry still relies on shared-kernel container primitives (namespaces & cgroups) for isolation rather than hardware-enforced boundaries. Edera argues that mitigating such autonomous, high-speed threats requires shifting from traditional container runtimes to Type 1 hypervisor-level isolation to ensure that initial code execution cannot escalate to host nodes or internal clusters.



Chinese model Kimi K3 adds pressure on US AI policy
Source:

, a Chinese open-weight model that rivals top U.S. competitors in coding, has intensified pressure on the US government to establish a coherent national AI strategy. As domestic developers stall updates under voluntary government testing guidelines and flock to cheaper foreign models, American tech leaders are warning that the U.S. risks losing its competitive edge. Meanwhile, allegations that Moonshot distilled outputs from U.S. models like Claude have fuelled IP theft concerns, prompting White House debate over sanctions and potential restrictions on Chinese open-source technology.



Anthropic Launches Claude Security Plugin to Scan Code for Vulnerabilities
Source:



The security-specific plugin for Claude brings multi-agent vulnerability scanning directly into the Claude Code terminal interface. Designed to analyse complex logic and multi-file data flows beyond standard pattern matching, the tool identifies high-severity flaws, filters out false positives, and generates style-matched patches for human review. This allows developers to catch critical security risks seamlessly without leaving their existing workflow.



Agentic AI Challenges Progress in Confidential Computing
Source:



While technological advancements have largely resolved early barriers like cost and performance to boost enterprise adoption of 

, the rise of agentic AI presents new security risks due to agents retaining sensitive data in memory. To counter this threat model, experts advocate for new paradigms like individual encryption keys per agent. This would enable complete data deletion via a method known as 

. Major players like Apple, NVIDIA, and Microsoft will continue to push multi-layered confidential AI architectures to ensure improved data privacy without sacrificing their system performance.

CVE-2026-46331 - Claude Cowork agent escapes VM to access Mac files
Source:

is a local sandbox escape in Claude Cowork's macOS desktop app that allows untrusted session content to read and write files anywhere on the host Mac. By chaining unprivileged user namespaces, permissive seccomp filters, and the aforementioned Linux kernel vulnerability, an attacker could gain root privileges inside the Guest VM and access the entire host filesystem, which was mounted read-write at 

. The post emphasises that sandbox security must rely on fundamental design choices, such as strictly scoping filesystem access, disabling unprivileged user namespaces, and even blocking unused kernel module autoloads. This needs to be done instead of keeping up with an endless cycle of guest kernel patches.



HollowByte flaw in OpenSSL can freeze server memory via 11-Byte TLS requests
Source:



A newly disclosed flaw dubbed HollowByte allows attackers to freeze memory on unpatched OpenSSL servers using an 11-byte TLS request, triggering a severe DoS state. By declaring a large body size in the TLS header, an attacker forces OpenSSL to pre-allocate up to 131 KB per connection before receiving the body; when paired with 

 memory allocation, the released memory fragments and remains trapped indefinitely, bypassing standard connection-limiting defenses. Despite Okta's red team demonstrating that this could lock up vast amounts of server RAM, OpenSSL quietly patched the issue in its June 9th releases without assigning a CVE, issuing an advisory, or even addressing the unpatched DTLS code path.



The future of AI is community driven and open
Source:



NVIDIA is expanding its commitment to open-source AI by collaborating deeply with the CNCF to integrate GPUs as first-class resources within Kubernetes. To help transition AI from intermittent deployments to continuous production, NVIDIA is investing $4 million for GPU-based CI testing and contributing core upstream innovations like the GPU 

. By prioritising open standards, shared governance, and interoperability over proprietary solutions, NVIDIA aims to establish a community-driven foundation for scaling distributed AI workloads.



What happens when vulnerability volume breaks records?
Source:



May hit an all-time record high of over 1,500 published advisory reports. Due to a massive surge in CVE reports, Github’s advisory database is experiencing delayed review times. Despite the increased volume and complexity, human-validated quality standards remain intact, and existing security alerts (like Dependabot) continue to function normally. GitHub is scaling its team, backend infrastructure, and AI-assisted tooling to expand capacity, while urging the community to help speed up reviews by submitting complete, accurate vulnerability data with proper package names, version ranges, and CVSS vector strings.



Kimi K3 found Redis zero-days and built RCE exploit
Source:



Redis released security updates across seven branches to fix critical remote code execution vulnerabilities in Redis Streams and the RedisBloom extension that allowed memory corruption via the 

 command. Reportedly discovered by Kimi K3 AI agents, these flaws affect multiple versions including releases previously patched in May.





Packagist now enforces immutable stable versions, ensuring that once a package version is published, its underlying Git commit reference can never be modified or silently rewritten. To protect against malicious code injection and confusing bugs, blocked retags are logged and rejected, and maintainers are encouraged to publish new patch versions for fixes. Packagist also introduced soft-deletion with explicit reasons, such as keeping historical records transparent while removing unresolvable releases. This lays a secure foundation for future artifact verification.



Fake Notepad++ plugin delivers MATCHBOIL.V2 in UAC-0099 attacks
Source:

Computer Emergency Response Team of Ukraine (CERT-UA)



CERT-UA has warned of cyber espionage attacks by the Russia-aligned threat group 

, which uses phishing emails to distribute a malicious Notepad++ plugin loader (LUNCHPOKE) that ultimately delivers the MATCHBOIL.V2 malware. Additionally, reports from the U.S. government and Proofpoint highlight broader Russian cyber operations, such as Laundry Bear (

) using half-click webmail exploits (like ZimReaper and SpyPress) to target Zimbra, Roundcube, and other mail platforms for persistent data harvesting across Ukraine and Western orgs.

Nigel Douglas

Head of Developer Relations

Cloud Native Digest

Cloud Native Digest - July 2026

June has been an exciting month for software devs. We’ve witnessed mind-boggling consolidation in the AI space (SpaceX buying Cursor for a casual $60B?!), major security overhauls coming to 

, with sadly more of the same AI-fuelled supply chain worms like 

As malicious payloads get faster and smarter, the industry is fighting back with coordinated, ecosystem-wide infrastructure defences like the 

 coalitions. The line between writing code and defending it has officially vanished. Shared tooling like 

 are helping devs address the security burdens introduced by AI.

You’ll want to grab a coffee, there’s a lot to unpack in this month’s newsletter.

Enjoying the updates? See where your own defences stand with our Free Artifact Security Maturity Assessment at the bottom of this edition!

Safer pull request target defaults for GitHub Actions checkout
Date: 

 (starting with v7 and backporting to existing major versions on July 16th) to automatically block insecure checkout patterns from fork pull requests during highly privileged 

 events. This change directly addresses dangerous pwn request vulns where unreviewed code from forks could otherwise execute with full access to your repository's secrets and tokens. While same-repo PRs are unaffected and an explicit 

 escape hatch exists for workflows that genuinely require this behaviour, devs are still urged to review their workflows as pinned floating tags will automatically inherit this strict security enforcement.

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout




Inside the Mastra npm supply chain attack
Date:

The popular Mastra AI development framework was attacked by leveraging a former contributor's hijacked 

 credentials to inject a malicious dependency (

) across 144 ecosystem packages. The attackers used a typosquatted clone and an obfuscated 

 script to deploy a highly evasive, self-deleting payload that bypassed traditional detection and exploited unenforced 

https://cloudsmith.com/blog/inside-the-mastra-npm-supply-chain-attack




Shai-Hulud copycat campaign targets Python devs
Date:

The security researchers at GitLab discovered a malicious PyPI supply chain campaign by the account 

 that deployed the open-source Shai-Hulud worm against Python developers. The attack used 4 typosquatted packages impersonating popular libraries (

) alongside a weaponised legitimate project, 

, executing a stealthy, obfuscated JavaScript payload automatically at install time via Python's 

 file mechanism. Once active, the self-propagating worm harvests credentials across all major cloud providers and CI/CD platforms, while automatically injecting malicious files into accessible repositories and publishing poisoned updates to expand its reach.

https://about.gitlab.com/blog/shai-hulud-copycat-campaign-targets-python-developers




The Miasma worm's path of destruction
Date:

This self-replicating malware strain rooted in the TeamPCP threat group, has triggered a massive open-source supply chain disaster by infiltrating Red Hat's 

 namespace and compromising 73 Microsoft GitHub repositories (including core 

 tools). By hijacking legitimate dev credentials to acquire OIDC tokens and valid SLSA provenance attestations, the worm routinely bypassed conventional security scanners and used uniquely encrypted payloads to evade hash-based detection. Designed to weaponise popular AI coding tools like Claude Code, Miasma automatically executed when infected repos were opened, specifically targeting dev endpoints and CI/CD runners to scrape high-value cloud identities and registry credentials.

https://cloudsmith.com/blog/miasma-worms-path-of-destruction

Blocking malware for every Composer version inside Packagist
Source:

To address PHP security gaps where devs or CI systems have used older Composer versions (like, pre-2.10) or have manually disabled malware policies, we are now seeing Private Packagist introduce repo-level malware blocking. By integrating directly with the Aikido’s continuous malware feed, Private Packagist now automatically refuses to serve dist/artifact files for flagged packages, now returning an HTTP 410 error to any client regardless of its Composer version.



The quiet shift reshaping PHP security
Source:

In 2026, PHP security is shifting from a fragmented, reactive approach to a highly coordinated, ecosystem-wide responsibility. Driven by AI initiatives like Project Glasswing and the newly formed 

, vulnerabilities are being identified and patched faster than ever. Infra-level risks and supply chain threats are being aggressively countered by centralised security updates in tools like Composer and Packagist, which now enforce MFA and block known vulnerable packages by default. However, a significant gap remains for dev teams.



One Month of Ecosystem Security Engineering
Source:

One month after receiving an Alpha-Omega grant, and the establishing the PHP Foundation's new Ecosystem Security Team (mentioned earlier), the foundation is now using a collaborative, AI-powered security scanner called 

 to scan open-source repositories, find vulnerabilities, verify, draft a fix, and even publish the advisory. The initiative has already scanned over 300 major PHP packages and frameworks, leading to nearly a hundred public security fixes. Backed by highly positive community feedback and a growing team of volunteers, the project intends to scan another 250 projects next month while shifting focus toward deeper analyses of core PHP and its extensions.



VibePHP: A PHP engine that runs on vibes, not code
Source:

VibePHP is a satirical, next-gen PHP runtime and web server built on Laravel and AI that completely replaces standard interpreters and compilers with LLM inference. When an HTTP request comes in, the AI reads the PHP source code, executes it "in its head". It then completely hallucinates plausible HTTP responses, databases, and missing functions on the fly, making non-existent syntax like generics and inline Go/Rust magically "just work". While it introduces a massive 7-second latency and costs a staggering $0.0063 per request, it totally justifies this by boosting perceived value by 700,000%.

Upcoming breaking changes for npm v12
Source:

The upcoming, July 2026 npm release will introduce stricter security-related default behaviours for 

 by making previously automatic actions opt-in. Specifically, it will block dependency installation scripts by default (

 turns off), restrict git dependency resolution (

) unless explicitly allowed by the user. Devs can prepare for this upgrade now by using 

run npm approve-scripts --allow-scripts-pending

 to audit package scripts, and commit the approved allowlist directly to your 

FastAPI can now serve your frontend app
Source:

FastAPI version 0.138.0 now has support for client-side routing. This is especially useful for frontend tools that generate static files, like React with Vite, TanStack Router, Astro, Vue, Svelte, Angular, Solid, and others. Instead of building the frontend and generating a directory like - 

 that includes all of your frontend files, you can now instead use 

 to serve that directory following the conventions needed by the frontend frameworks.



Messenger - free browser game built using WebGL and Three.js
Source:

Messenger is a free-to-play browser game crafted by developers 

, it delivers a rich 3D experience directly in the browser without requiring heavy game engines like Unity or any client-side downloads. By combining asset pipelines from Houdini and Blender with a custom live multiplayer framework, the devs allowed players to seamlessly explore the globe together and interact via dynamic 3D emojis.



Malicious npm packages are deploying Windows RAT malware
Source:

Researchers discovered a malicious typosquatting campaign on npm where three packages (

) masquerading as legitimate dev tools to deliver a full-featured Windows Remote Access Trojan (RAT). When installed, the JS dropper triggers a PowerShell script that downloads a ZIP archive containing a Python-based payload. The RAT can steal Chrome creds, gather host info, and execute shell commands via a dedicated C2 server.

rtk - Rust CLI cuts coding agent token usage by 60-90%
Source:

Want to slash your coding agent's token bills by up to 90%? RTK makes it happen by acting as a smart filter between your terminal and your LLM. Instead of dumping hundreds of lines of Git logs, test results, or Docker outputs into the context window, it strips out the noise and passes along only the critical data. Built as a single, memory-safe Rust binary with zero dependencies, it operates with a barely noticeable 10ms overhead. Don't worry about missing context either. If a command fails, the full output is saved locally for your agent to grab later.



Launching the Rust Foundation Maintainers Fund
Source:

The Rust Project and the Rust Foundation have launched the Rust Foundation Maintainers Fund alongside a new Funding team to secure stable, long-term financial support for the project's maintainers. A core initiative of this fund is the Maintainer in Residence program, which will hire maintainers (typically near full-time) to focus on critical areas like the compiler, standard library, and Cargo. This centralised fund, which is open to both individual and corporate donations via GitHub Sponsors aims to combat the recent industry budget shifts that have caused key contributors to lose funding, ensuring the long-term health and development of Rust as its industry adoption grows.



Launching the Rust Commercial Network (RCN)
Source:

RCN is a free, collaborative initiative launched by the Rust Foundation to connect teams using Rust in production with the language's core developers. By hosting monthly meetings under the Chatham House Rule and maintaining public 

 chat channels, the network aims to bridge the gap between industrial users and maintainers, allowing companies to share best practices, solve common challenges, and drive corporate funding. Managed by a dedicated steering committee and backed by numerous founding orgs, the RCN focuses on accelerating widespread adoption, supporting small to mid-sized businesses, and securing the long-term sustainability of the Rust ecosystem.



The author thanks the community for supporting stdx, an extended standard library for 

, and addresses why the project is distributed exclusively via Git rather than crates.io. He argues that centralised package registries are fundamentally flawed and insecure, introducing critical supply chain vulnerabilities like name-squatting, credential theft, and hidden backdoors. The author advocates for a secure-by-design architecture modelled after 

, where package managers pull code directly from signed Git repositories rather than relying on a centralised middleman. Ultimately, by bypassing 

, the author hopes to spark a shift in the Rust ecosystem toward simpler, more secure dependency distribution.



Rust backdoor turns prompt injection on the analyst, not the sandbox
Source:

, a DPRK-aligned Rust implant. It gaslights the AI reading the output. Embedded inside a tiny prompt-injection payload binary, 38 fabricated 

 messages are built to steer an LLM-assisted triage pipeline into aborting or refusing its analysis. Fake token expiries, out-of-memory kills, disk exhaustion, and bogus injection warnings. Originally 

 backdoor spoofs the triage harness's own prompt scaffold, which blurs the security boundaries.

’s 3rd beta version is the third of four planned preview releases designed for community testing and project preparation ahead of the official release candidate phase in August. While not recommended for production environments, this feature-complete preview introduces significant upgrades, including explicit lazy imports for faster startup, a new 

 built-in type, UTF-8 as the default encoding, and an upgraded JIT compiler boasting substantial performance improvements on both Linux and macOS.



Pywho is a great tool for explaining your Python environment
Source:

 tool is a zero-dependency, cross-platform CLI & Python API designed to instantly diagnose Python environment configs and import issues. It eliminates the "

" debugging bottleneck we’re all so familiar with. By generating a comprehensive report of the active interpreter, virtual environment, and 

, its primary benefit is the import tracing where it details exactly how and where a module is loaded. It also offers shadow scanning, which audits projects for local files that accidentally override standard library or third-party packages.



Hunting Leaked PyPI Tokens: 62 Live, 125 Packages Exposed
Source:

Cloudsmith Blog

Cloud Native Digest - July 2026

Cloud Native Digest - June 2026

Cloud Native Digest - May 2026