Field notes · Architecture · Security

Ideas tested against real systems.

Technical investigations, architecture decisions, and lessons from building products that have to work beyond the demo.

Developer security7 min read

The strange code changes that led me to a supply-chain attack

Files vanished, code changed without explanation, and an OS reinstall did not solve it. The real clue was obfuscated JavaScript hiding in a PostCSS configuration file.

  • Supply-chain security
  • npm
  • Incident analysis
  • Node.js