Security Articles
All GeekWala articles in the Security category.
Reachability vs EPSS: Cutting False Positives
Two scanners, same repo, two different finding counts. Neither is wrong. Reachability asks whether your code calls the vulnerable function. EPSS asks whether anyone will exploit it. How they compare, where each fails, and how to combine them without discarding the KEV signal that matters most.
Transitive Dependency Risk: What You Can't See
Your package.json lists a dozen packages; your lockfile resolves over a thousand. Sonatype puts roughly 6 in 7 known vulnerabilities in that transitive layer. Here's how to trace one to its parent and the four ways to actually fix it.
Most Exploited Vulnerabilities: Q2 2026 Edition
Our quarterly analysis of the most dangerous open-source vulnerabilities, covering April through June 2026. This edition also explains why we moved from a monthly to a quarterly cadence and catches up the gap since March's inaugural report.
Slopsquatting: Auditing AI-Generated Deps
AI coding assistants generate dependencies as confidently as they generate code — but many suggestions are hallucinated, outdated, or unnecessary. This 4-step audit checklist catches slopsquatting and other AI-generated dependency risks before they reach production.
What Is VEX? Vulnerability Exploitability
Your SBOM says you use a vulnerable package. But does the vulnerability actually affect your product? VEX answers that question with a machine-readable document that states whether a known CVE is exploitable, not affected, under investigation, or fixed in your specific product.
Software Supply Chain Security for Developers
Supply chain attacks doubled in 2025, most often through compromised dependencies. This guide covers the practical security layers — dependency scanning, SBOM generation, vulnerability triage, and CI/CD hardening — that protect your software without slowing your team down.
Your Scanner Found 200 CVEs: What to Do
Alert fatigue is the #1 reason teams ignore vulnerability scanners. A developer opens the dashboard, sees 200 red CVEs, and closes the tab. This article is the actionable playbook that turns 200 alerts into a 3-item "fix today" list using the 3-Signal Triage Method (CVSS + EPSS + KEV).
Dependency Confusion Attacks Explained
Dependency confusion is a supply chain attack where attackers register public packages with the same name as your private internal packages. Your package manager installs the attacker's version instead. Here's how it works, which ecosystems are vulnerable, and what you can do about it.
Most Exploited Vulnerabilities: March 2026
Our monthly analysis of the most dangerous open-source vulnerabilities. March 2026 saw new CISA KEV additions across npm and PyPI, rising EPSS scores on Java libraries, and a continued trend of supply chain attacks targeting build tooling.
OSV vs NVD: Comparing Vulnerability Databases
NVD has been the default vulnerability database for decades, but OSV offers ecosystem-native advisories with faster coverage. Learn how the two databases differ, where each excels, and how GeekWala builds on OSV with EPSS and CISA KEV.
Supply Chain Attacks: What Scanners Catch in 2026
Dependency scanners catch known CVEs in legitimate packages. Supply chain attacks are different — malicious code injected by attackers who compromise maintainers or publish typosquatted packages. Here's what scanning covers and the defense layers you need for the rest.
What Is Dependency Vulnerability Scanning?
Dependency vulnerability scanning finds known security flaws in your project's third-party packages. This guide covers how scanning works, why CVSS alone isn't enough for prioritization, and how to build a practical workflow across all major ecosystems.