DevSec Station Thu, 30 Jul 2026 14:53:32 -0400 https://www.devsecstation.com en-us © 2026 SheHacksPurple yes 0524789b-8a5b-5e00-8df8-a10228cd6845 Tanya Janca | SheHacksPurple episodic false DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you level up.

]]> Buzzsprout (https://www.buzzsprout.com) DevSecOps, Secure Coding, Application Security, Software Security, Threat Modeling, software supply chain, DevSec, AI Security, OWASP, AppSec, Vulnerability Management, software supply chain Security Tanya Janca | SheHacksPurple https://storage.buzzsprout.com/7ti250r8yayajke2slay0871bmlm?.jpg DevSec Station https://www.devsecstation.com Tanya Janca | SheHacksPurple Secure Defaults Beat Secure Training Secure Defaults Beat Secure Training Security training has its place. But if training alone solved security problems, we wouldn't keep seeing the same vulnerabilities appear over and over again. The real problem usually isn't that developers don't know what to do; it's that the easiest path is often an insecure one.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explains why secure defaults are one of the most effective security controls you can implement, why relying on memory and willpower rarely works under pressure, and how small changes to your development workflow can prevent the same mistakes from happening again. You'll learn why better systems consistently outperform good intentions. 

You'll learn:

  •  why training alone isn't enough to improve security 
  •  how insecure defaults quietly create recurring security issues 
  •  why developers naturally follow the path of least resistance 
  •  how secure defaults reduce mistakes without slowing teams down 
  •  practical ways to improve security by changing one default at a time 

Tanya walks through a familiar day in the life of a busy developer, showing how insecure defaults become "normal" simply because they're already there. She explains why this isn't a developer problem (it's a systems design problem) and how thoughtful defaults can improve security for every future decision. 

If you do just one thing after listening to this episode:

Choose one repository you actively work on and improve a single insecure default.

For example:

  •  update a configuration file so it starts with more secure settings 
  •  enable security checks in your CI pipeline to run every time 
  •  improve a project template so authentication, logging, or validation are included automatically 
  •  replace scripts that rely on plain text secrets to perform proper secret management instead 

You don't have to redesign your entire development process. One better default today can prevent countless mistakes tomorrow.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:

This episode is sponsored by Maze.

One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Security training has its place. But if training alone solved security problems, we wouldn't keep seeing the same vulnerabilities appear over and over again. The real problem usually isn't that developers don't know what to do; it's that the easiest path is often an insecure one.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explains why secure defaults are one of the most effective security controls you can implement, why relying on memory and willpower rarely works under pressure, and how small changes to your development workflow can prevent the same mistakes from happening again. You'll learn why better systems consistently outperform good intentions. 

You'll learn:

  •  why training alone isn't enough to improve security 
  •  how insecure defaults quietly create recurring security issues 
  •  why developers naturally follow the path of least resistance 
  •  how secure defaults reduce mistakes without slowing teams down 
  •  practical ways to improve security by changing one default at a time 

Tanya walks through a familiar day in the life of a busy developer, showing how insecure defaults become "normal" simply because they're already there. She explains why this isn't a developer problem (it's a systems design problem) and how thoughtful defaults can improve security for every future decision. 

If you do just one thing after listening to this episode:

Choose one repository you actively work on and improve a single insecure default.

For example:

  •  update a configuration file so it starts with more secure settings 
  •  enable security checks in your CI pipeline to run every time 
  •  improve a project template so authentication, logging, or validation are included automatically 
  •  replace scripts that rely on plain text secrets to perform proper secret management instead 

You don't have to redesign your entire development process. One better default today can prevent countless mistakes tomorrow.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:

This episode is sponsored by Maze.

One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Tanya Janca | SheHacksPurple Buzzsprout-19503769 Wed, 29 Jul 2026 13:00:00 -0800 411 1 8 full false Why Current Security Tools Fail Developers Why Current Security Tools Fail Developers Security tools are supposed to help developers build safer software. But sometimes it seems like they create more frustration than security.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explains why many security tools overwhelm developers with alerts, how alert fatigue erodes trust, and why "more findings" doesn't mean "more security." You'll learn how to tune your classic AppSec tools so they surface meaningful issues instead of creating noise that everyone eventually ignores.

You'll learn:
• why classic AppSec tools often optimize for coverage instead of developer workflows
• how alert fatigue develops and why it leads to missed vulnerabilities
• why developers ignore noise (not security)
• how to improve signal-to-noise in your existing tools
• practical ways to make security tools work with your development process

Tanya walks through a familiar scenario: running a security scan that produces hundreds of findings, spending valuable time triaging alerts, then eventually starting to ignore the noise. She explains why this isn't a developer failure; it's the predictable result of tools that don't distinguish between theoretical issues and meaningful risk.

If you do just one thing after listening to this episode:

Pick one security tool you already use (SCA, SAST, or a secrets scanner) and tune it to better respect your time.

For example:
• prioritize high-severity, reachable findings
• highlight newly introduced issues instead of historical backlog
• filter or downgrade specific types of findings your team never acts on
• configure the tool to surface issues as early as possible in your workflow

The goal isn't to ignore security, it's to make the important signals very loud and visible.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:

This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Security tools are supposed to help developers build safer software. But sometimes it seems like they create more frustration than security.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explains why many security tools overwhelm developers with alerts, how alert fatigue erodes trust, and why "more findings" doesn't mean "more security." You'll learn how to tune your classic AppSec tools so they surface meaningful issues instead of creating noise that everyone eventually ignores.

You'll learn:
• why classic AppSec tools often optimize for coverage instead of developer workflows
• how alert fatigue develops and why it leads to missed vulnerabilities
• why developers ignore noise (not security)
• how to improve signal-to-noise in your existing tools
• practical ways to make security tools work with your development process

Tanya walks through a familiar scenario: running a security scan that produces hundreds of findings, spending valuable time triaging alerts, then eventually starting to ignore the noise. She explains why this isn't a developer failure; it's the predictable result of tools that don't distinguish between theoretical issues and meaningful risk.

If you do just one thing after listening to this episode:

Pick one security tool you already use (SCA, SAST, or a secrets scanner) and tune it to better respect your time.

For example:
• prioritize high-severity, reachable findings
• highlight newly introduced issues instead of historical backlog
• filter or downgrade specific types of findings your team never acts on
• configure the tool to surface issues as early as possible in your workflow

The goal isn't to ignore security, it's to make the important signals very loud and visible.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:

This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Tanya Janca | SheHacksPurple Buzzsprout-19500462 Wed, 15 Jul 2026 13:00:00 -0800 389 1 7 full true Vibe Coding, Copilots, and Security Drift Vibe Coding, Copilots, and Security Drift AI coding assistants can help developers move incredibly fast. But this new speed comes with a new challenge: security drift.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explores how tools like GitHub Copilot, ChatGPT, Cursor, and other AI coding assistants can unintentionally change the security assumptions your software was built on. You'll learn what security drift is, why it happens so quietly, and how to keep the benefits of AI-assisted development without letting important security controls slowly disappear.

You'll learn:
• what security drift is and why it matters
• how AI-generated code can subtly change security assumptions
• why confidence and correctness are not the same thing
• how security controls disappear during seemingly harmless refactors
• practical ways to add guardrails to AI-assisted development workflows

Tanya walks through a realistic example of how authentication checks, input validation, and logging can slowly weaken over time as AI-generated code evolves through multiple edits and refactors. The code still works, the tests still pass, but the security posture is no longer what the team originally intended.

One practical action from this episode:

Choose one security-sensitive area where AI generates code for you, such as authentication, authorization, input validation, or secrets handling.

Then:
• identify a known-good secure implementation
• require AI-generated code to follow that pattern
• add a review step or checklist item
• automate enforcement where possible using tests, linters, static analysis, prompts, or a RAG server

The goal isn't to slow down or ban AI. It's to prevent AI from making security decisions on your behalf.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:

This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> AI coding assistants can help developers move incredibly fast. But this new speed comes with a new challenge: security drift.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explores how tools like GitHub Copilot, ChatGPT, Cursor, and other AI coding assistants can unintentionally change the security assumptions your software was built on. You'll learn what security drift is, why it happens so quietly, and how to keep the benefits of AI-assisted development without letting important security controls slowly disappear.

You'll learn:
• what security drift is and why it matters
• how AI-generated code can subtly change security assumptions
• why confidence and correctness are not the same thing
• how security controls disappear during seemingly harmless refactors
• practical ways to add guardrails to AI-assisted development workflows

Tanya walks through a realistic example of how authentication checks, input validation, and logging can slowly weaken over time as AI-generated code evolves through multiple edits and refactors. The code still works, the tests still pass, but the security posture is no longer what the team originally intended.

One practical action from this episode:

Choose one security-sensitive area where AI generates code for you, such as authentication, authorization, input validation, or secrets handling.

Then:
• identify a known-good secure implementation
• require AI-generated code to follow that pattern
• add a review step or checklist item
• automate enforcement where possible using tests, linters, static analysis, prompts, or a RAG server

The goal isn't to slow down or ban AI. It's to prevent AI from making security decisions on your behalf.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:

This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Tanya Janca | SheHacksPurple Buzzsprout-19369779 Wed, 01 Jul 2026 01:00:00 -0800 470 1 6 full false Secrets Management: Stop Playing Whack-a-Mole Secrets Management: Stop Playing Whack-a-Mole If you've ever committed an API key, password, token, certificate, or other secret to a repository, you're not alone. Most secret leaks don't happen because developers don't care about security. They happen because the easiest place to put a secret is inside the code that uses it.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explains why secrets leak, why "just be careful" isn't an effective security strategy, and how developers can stop playing whack-a-mole with exposed credentials. You'll learn why secrets belong outside of source control, how secret scanning can help you find problems before attackers do, and what practical steps you can take to improve your workflow today.

You'll learn:
• why repositories are terrible places to store secrets
• how leaked secrets are discovered and exploited
• why secret leaks are a workflow problem, not a developer problem
• the difference between reacting to leaks and preventing them
• how secrets management tools reduce risk and operational headaches

Tanya walks through a realistic example of how a secret accidentally makes its way into source control, what happens next, and how teams end up trapped in a cycle of rotating credentials and cleaning up incidents. She also shares a practical, developer-friendly process for finding and fixing exposed secrets before they become bigger problems.

One practical action from this episode:

Run a secrets scanner against every repository you actively work on. If you find a real secret:
• rotate it immediately
• move it into a secrets management solution
• update the code so the secret is retrieved securely at runtime

And if your team doesn't have a secrets management tool yet, make the business case for one.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:

This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> If you've ever committed an API key, password, token, certificate, or other secret to a repository, you're not alone. Most secret leaks don't happen because developers don't care about security. They happen because the easiest place to put a secret is inside the code that uses it.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explains why secrets leak, why "just be careful" isn't an effective security strategy, and how developers can stop playing whack-a-mole with exposed credentials. You'll learn why secrets belong outside of source control, how secret scanning can help you find problems before attackers do, and what practical steps you can take to improve your workflow today.

You'll learn:
• why repositories are terrible places to store secrets
• how leaked secrets are discovered and exploited
• why secret leaks are a workflow problem, not a developer problem
• the difference between reacting to leaks and preventing them
• how secrets management tools reduce risk and operational headaches

Tanya walks through a realistic example of how a secret accidentally makes its way into source control, what happens next, and how teams end up trapped in a cycle of rotating credentials and cleaning up incidents. She also shares a practical, developer-friendly process for finding and fixing exposed secrets before they become bigger problems.

One practical action from this episode:

Run a secrets scanner against every repository you actively work on. If you find a real secret:
• rotate it immediately
• move it into a secrets management solution
• update the code so the secret is retrieved securely at runtime

And if your team doesn't have a secrets management tool yet, make the business case for one.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:

This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Tanya Janca | SheHacksPurple Buzzsprout-19364579 Wed, 17 Jun 2026 17:00:00 -0800 428 1 5 full false Supply Chain Is More Than Just Dependencies Supply Chain Is More Than Just Dependencies Most developers think software supply chain security starts and ends with dependencies. But modern supply chain attacks don't stop there. Attackers look for paths into your software, and those paths often run through developers, CI/CD systems, build tools, deployment pipelines, and other trusted parts of the software delivery process.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explains why the software supply chain is much bigger than libraries and packages, how modern attacks move through trusted systems, and what developers can do to better understand and protect the paths their software travels before it reaches production.

You'll learn:
• why dependencies are only one part of the supply chain
• how attackers move through trusted developer tooling and processes
• what "influence" means in a software supply chain context
• why supply chain attacks often appear normal until it's too late
• how to identify and protect the paths that affect your software

Tanya walks through a realistic supply chain attack scenario where no application vulnerability is exploited directly. Instead, an attacker compromises a trusted part of the software delivery process and uses it to influence what gets built and deployed.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:



This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Most developers think software supply chain security starts and ends with dependencies. But modern supply chain attacks don't stop there. Attackers look for paths into your software, and those paths often run through developers, CI/CD systems, build tools, deployment pipelines, and other trusted parts of the software delivery process.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explains why the software supply chain is much bigger than libraries and packages, how modern attacks move through trusted systems, and what developers can do to better understand and protect the paths their software travels before it reaches production.

You'll learn:
• why dependencies are only one part of the supply chain
• how attackers move through trusted developer tooling and processes
• what "influence" means in a software supply chain context
• why supply chain attacks often appear normal until it's too late
• how to identify and protect the paths that affect your software

Tanya walks through a realistic supply chain attack scenario where no application vulnerability is exploited directly. Instead, an attacker compromises a trusted part of the software delivery process and uses it to influence what gets built and deployed.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:



This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Tanya Janca | SheHacksPurple Buzzsprout-19289439 Thu, 04 Jun 2026 12:00:00 -0800 420 1 4 full false Malicious Dependencies Aren’t an Accident Malicious Dependencies Aren’t an Accident Malicious dependencies are not accidents. They are often intentionally designed to look trustworthy so developers install them without hesitation. In this episode of DevSec Station, Tanya Janca explains how attackers use typosquatting, dependency confusion, fake packages, and even AI-generated recommendations to compromise developer environments and steal credentials. 

This episode is sponsored by Maze.

You’ll learn:
• how malicious packages trick developers
• why dependency attacks work so well
• how attackers abuse trust and speed
• why “just be careful” is not an effective defense
• practical ways to add safer guardrails to your development workflow

Tanya walks through a realistic example of a dependency stealing AWS credentials, explains why this is a workflow problem instead of a developer failure, and shares practical steps you can take immediately to reduce risk in your own projects.

One practical action from this episode:
Require new dependencies to go through pull request review, and add lightweight checks that help your team verify package names and sources before installation.

DevSec Station is a podcast by Tanya Janca, focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:
• https://shehackspurple.ca
• https://newsletter.shehackspurple.ca
• https://linkedin.com/in/tanya-janca
• https://www.youtube.com/shehackspurple
• https://TanyaJanca.com  


This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Malicious dependencies are not accidents. They are often intentionally designed to look trustworthy so developers install them without hesitation. In this episode of DevSec Station, Tanya Janca explains how attackers use typosquatting, dependency confusion, fake packages, and even AI-generated recommendations to compromise developer environments and steal credentials. 

This episode is sponsored by Maze.

You’ll learn:
• how malicious packages trick developers
• why dependency attacks work so well
• how attackers abuse trust and speed
• why “just be careful” is not an effective defense
• practical ways to add safer guardrails to your development workflow

Tanya walks through a realistic example of a dependency stealing AWS credentials, explains why this is a workflow problem instead of a developer failure, and shares practical steps you can take immediately to reduce risk in your own projects.

One practical action from this episode:
Require new dependencies to go through pull request review, and add lightweight checks that help your team verify package names and sources before installation.

DevSec Station is a podcast by Tanya Janca, focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:
• https://shehackspurple.ca
• https://newsletter.shehackspurple.ca
• https://linkedin.com/in/tanya-janca
• https://www.youtube.com/shehackspurple
• https://TanyaJanca.com  


This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

]]> Tanya Janca | SheHacksPurple Buzzsprout-19213715 Wed, 20 May 2026 16:00:00 -0800 469 1 3 full false NPM Supply Chain Attack: Active Worm Stealing Tokens, SSH Keys, and Credentials NPM Supply Chain Attack: Active Worm Stealing Tokens, SSH Keys, and Credentials 🚨 Emergency DevSec Station update.

There’s an active npm supply chain attack happening right now.

Malicious npm packages are running install scripts that quietly steal:
 • SSH keys
 • AWS credentials
 • GitHub tokens
 • Browser passwords
 • Crypto wallets

From there, the attack uses your npm publish token to spread into every package you maintain. That’s how this turns into a worm across the npm ecosystem.

This is not theoretical. It’s already in the wild.

👉 Immediate fix:
 Run
 npm config set ignore-scripts true

This disables install scripts and blocks the main attack path.

If you work in JavaScript, Node.js, DevSecOps, or application security, take action now and tell your team.

Watch the full 2 minute breakdown and share this with anyone who installs npm packages.

#npmSecurity #SupplyChainAttack #DevSecOps #AppSec #JavaScriptSecurity #CyberSecurityAlert

Follow Tanya:


]]> 🚨 Emergency DevSec Station update.

There’s an active npm supply chain attack happening right now.

Malicious npm packages are running install scripts that quietly steal:
 • SSH keys
 • AWS credentials
 • GitHub tokens
 • Browser passwords
 • Crypto wallets

From there, the attack uses your npm publish token to spread into every package you maintain. That’s how this turns into a worm across the npm ecosystem.

This is not theoretical. It’s already in the wild.

👉 Immediate fix:
 Run
 npm config set ignore-scripts true

This disables install scripts and blocks the main attack path.

If you work in JavaScript, Node.js, DevSecOps, or application security, take action now and tell your team.

Watch the full 2 minute breakdown and share this with anyone who installs npm packages.

#npmSecurity #SupplyChainAttack #DevSecOps #AppSec #JavaScriptSecurity #CyberSecurityAlert

Follow Tanya:


]]> Tanya Janca | SheHacksPurple Buzzsprout-19060746 Wed, 22 Apr 2026 09:00:00 -0800 149 1 bonus false How Modern Supply Chain Attacks Really Happen (Step-by-Step Breakdown for Developers) How Modern Supply Chain Attacks Really Happen (Step-by-Step Breakdown for Developers) What if a supply chain attack didn’t start with a complex exploit… but something completely normal?

A typo.
 A copy-paste.
 Even an AI suggestion.

In this episode, Tanya Janca breaks down how modern supply chain attacks actually happen inside everyday developer workflows.

These attacks aren’t one big moment. They’re a series of small, reasonable decisions that quietly introduce risk.

You’ll learn:
 • Why supply chain attacks are a process, not a single event
 • How attackers exploit normal developer behavior
 • A simple, step-by-step example of a real attack path
 • Why traditional SCA tools often miss real risk
 • How to focus on what actually matters

👉 If you do one thing this week:
 Run your SCA tool with reachability enabled and fix one real issue. That’s how you start reducing risk.

If you work in DevSecOps, application security, or software development, you need to understand this.

Follow Tanya:

]]> What if a supply chain attack didn’t start with a complex exploit… but something completely normal?

A typo.
 A copy-paste.
 Even an AI suggestion.

In this episode, Tanya Janca breaks down how modern supply chain attacks actually happen inside everyday developer workflows.

These attacks aren’t one big moment. They’re a series of small, reasonable decisions that quietly introduce risk.

You’ll learn:
 • Why supply chain attacks are a process, not a single event
 • How attackers exploit normal developer behavior
 • A simple, step-by-step example of a real attack path
 • Why traditional SCA tools often miss real risk
 • How to focus on what actually matters

👉 If you do one thing this week:
 Run your SCA tool with reachability enabled and fix one real issue. That’s how you start reducing risk.

If you work in DevSecOps, application security, or software development, you need to understand this.

Follow Tanya:

]]> Tanya Janca | SheHacksPurple Buzzsprout-19017150 Tue, 14 Apr 2026 13:00:00 -0800 614 1 2 full false Developers Are Now Targets: How Supply Chain Attacks Actually Reach You Developers Are Now Targets: How Supply Chain Attacks Actually Reach You Developers are no longer just building software.
 They’re being targeted directly.

In this episode, Tanya Janca explains how supply chain attacks reach developers through everyday tools, packages, and workflows.

These attacks don’t feel like attacks at first. They look like normal development work until it’s too late.

You’ll learn:
 • How supply chain attacks reach individual developers
 • Why developer environments are now high-value targets
 • Where risk shows up in daily workflows
 • Simple ways to protect yourself without slowing down

If you work in JavaScript, DevSecOps, or application security, this shift matters.

👉 Start by reviewing what you install, what runs during install, and what your tools are actually doing behind the scenes.

#SupplyChainSecurity #DevSecOps #AppSec #SecureCoding #SoftwareSecurity #DeveloperSecurity

]]> Developers are no longer just building software.
 They’re being targeted directly.

In this episode, Tanya Janca explains how supply chain attacks reach developers through everyday tools, packages, and workflows.

These attacks don’t feel like attacks at first. They look like normal development work until it’s too late.

You’ll learn:
 • How supply chain attacks reach individual developers
 • Why developer environments are now high-value targets
 • Where risk shows up in daily workflows
 • Simple ways to protect yourself without slowing down

If you work in JavaScript, DevSecOps, or application security, this shift matters.

👉 Start by reviewing what you install, what runs during install, and what your tools are actually doing behind the scenes.

#SupplyChainSecurity #DevSecOps #AppSec #SecureCoding #SoftwareSecurity #DeveloperSecurity

]]> Tanya Janca | SheHacksPurple Buzzsprout-18883801 Sat, 21 Mar 2026 06:00:00 -0800 361 1 1 full false