The Javascript ecosystem explained through Python. Learn how runtime, package manager and event loop impacts modern web security

Part 1 of my AppSec transformation series — auditing, exploiting, and rebuilding a 2022 inventory system from the ground up.

A breakdown of hashing versus encryption for developers who store customer passwords, with working TypeScript examples using bcrypt…

At a glance Malware family Node.js backdoor (tracked as “TonRAT” by some researchers) Threat actor Unattributed; no named group Target / victims Hospitality sector; hotel staff Deliver…

TL;DR Node.js shipped fixes for 11 vulnerabilities on 29 July 2026. Three are rated high severity, and the rest are medium or low. The updates cover the 26.x, 24.x, and 22.x release lines. No in-t…

Room: Do Not Disturb (https://tryhackme.com/room/hh-donotdisturb-84a45644) Platform: TryHackMe Difficulty: Medium Category: Boot2Root /…

Most Node.js apps have an auth middleware. You write a protect function, drop it on your routes and call it done. That works fine until you…

Use this repository as a reference guide throughout your software development life cycle, whether you are releasing a new build, applying a…

The setup

Why authentication isn’t enough and where authorization actually belongs.

How browser geolocation, WebSockets, and an interactive map come together in one educational project

Three separate CVSS 10.0 sandbox escapes landed days apart — in a library that was declared dead once already

Building a REST API is only one part of exposing a service to consumers. Once an API is used by multiple applications or users, additional…

Building a Red vs Blue Cyber Range for Cookies Reuse and MFA Bypass A practical write-up on designing the attack story, building the lab, validating the result, and making the evidence visible. I …

Here’s a sentence that should sound impossible: sharing a link to a website could let someone run code on that website’s server. Not…

TL;DR: A path traversal vulnerability in the npm package image-downloader (< 4.3.1, ~38,000 downloads/month) lets an attacker write files…

Finding and Fixing Broken Access Control: A Case Study on Unauthenticated Admin Pages

An unexpected security incident in a Node.js project taught me why we should never blindly trust scripts loaded from external sources.

Not every file our upload endpoint accepts deserves the same treatment.