### Summary A path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory. The vulnerability has two attack vecto...
Zip Path Traversal | Security | Android Developers
The Zip Path Traversal vulnerability, also known as ZipSlip, is related to handling compressed archives. On this page, we demonstrate this vulnerability using the ZIP format as an example, but similar problems can arise in libraries handling other formats, like TAR, RAR, or 7z.
Zip Slip, Path Traversal Vulnerability during File Decompression - ASEC
Zip Slip, Path Traversal Vulnerability during File Decompression ASEC
Secure coding technique: Default behavior of Zip libraries can lead to Remote Code Execution - Blog
This week we are going to talk about the default behavior of Zip libraries. If you are an application developer, it is very likely that you have used this before. Most resources that are downloaded over the internet are in zip format, this makes sense; compressed data is smaller, so it downloads faster and consumes less bandwidth.
PBF Format - OpenStreetMap Wiki
PBF format ("Protocolbuffer Binary Format") is primarily intended as an alternative to the XML format. It is about half of the size of a gzipped planet and about 30% smaller than a bzipped planet. It is also about 5x faster to write than a gzipped planet and 6x faster to read than a gzipped planet. The format was designed to support future extensibility and flexibility.
RAFS Filesystem | dragonflyoss/nydus | DeepWiki
RAFS (Registry Acceleration File System) is a read-only, chunk-deduplicated, on-demand-loading filesystem designed for container image serving. The filesystem implementation is located in the `rafs/`
Download pumping: New npm deception technique for supply chain attacks
Learn how attackers exploit automated bot traffic as part of software supply chain attacks to artificially inflate download counters and mask malicious payloads as legitimate.
How to Prevent Zip File Exploitation | CrowdStrike
This blog post explores how the zip file format can be exploited and shares the solution the CrowdStrike team came up with.
How programs get run: ELF binaries
The previous article in this series described the general mechanisms that th [...]
Content Model & Wire Format — szzt docs
The on-PDS content model and the wire formats of a Szzt (a.k.a. "Mini-Site" / @minisite) mini-site: the three atproto records that describe a site, the StrongRef links between them, the CID codecs, the byte encodings, and how a served request path resolves to a specific block of bytes. A compatible publisher writes these records; a compatible verifier re-derives every CID from signed state and trusts no source's assertion.
The secure way to release an npm package in 2026—Martian Chronicles, Evil Martians’ team blog
How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings
blooym.dev/porxie
[MIRROR ONLY] A correct and efficient ATProto blob proxy for secure content delivery.
mohsen1/yek
A fast Rust based tool to serialize text-based files in a repository or directory for LLM consumption
Tock OS A Rust Based Open Platform for Transparent and Secure Root of Trust Devices
What If npm Ran on AT Protocol?
A thought experiment about what a package registry would look like if built on atproto.
Blooym/porxie
[Mirror] A correct and efficient ATProto blob proxy for secure content delivery.