Depi Research
Public research from the Depi team: named attack classes, novel exploit patterns, and threat-intel posts on what moves in upstream security.
- Posts
- 20 from 4 Apr 2023 to 9 Oct 2026
- Posting
- monthly (8 in the last year)
- Kind
- company blog
- Feed
- https://depi.security/rss.xml
2026 8
- Mean Time to Destroy MTTD
- Find Comment, Get Shell: Command Injection in dbt’s GitHub Actions
- npx Used Confusion and It’s Super Effective
- node-ipc Compromised: A Dormant Maintainer, an Expired Domain, and What We Think Happened
- TanStack Compromised: Inside the GitHub Actions Cache Poisoning That Hit the npm Ecosystem
- First Week, First Hack: Compromising a Package with 40 Million Weekly Downloads
- One Label Away from Backdooring 80 million installations per week
- How Ledger Donjon Used Depi to Neutralize a Stealth Supply Chain Threat
2025 6
- We Hacked the npm Supply Chain of 36 Million Weekly Installs
- Depi is Now Available on AWS Marketplace !
- Netflix Vulnerability: Dependency Confusion in Action
- We hacked Google’s A.I Gemini and leaked its source code (at least some part)
- Depi Launch: A New Approach to Software Supply Chain Security
- How We Hacked a Software Supply Chain for $50K