Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

This post is an unfortunate affirmation of our prior research into abandoned open-source packages, where we found that 11% of the most-downloaded packages have been abandoned and not actively maintained, becoming invisible vulnerabilities to your scanner. Today we share a zip-slip vulnerability we found in extract-zip (CVE-2026-19693), an npm package with over 20 million weekly downloads.

How to evaluate your options, price the status quo, and make a decision your executive team will actually approve. A note on the numbers. The salaries, headcounts, and costs in this guide are illustrative. They're drawn to be realistic so the math works the way it does in a real budget meeting - but they're examples, not benchmarks. Replace them with your own.

We discovered this new vulnerability as part of our abandoned-packages research. Despite what seems like a 2-year hiatus, fflate is one of the few popular npm packages that released a fix for the vulnerabilities we found merely using Sonnet-4.6, giving its 50M+ users a chance to upgrade to a safe version.

In a previous post we looked at the skills CLI by vercel-labs/skills and ways for a malicious skill to overwrite an existing trusted skill by using homoglyph names or abusing weird CLI behaviors. This post will delve into an OSC-8 escape injection we found in the skills add command, which lets a skill author write arbitrary text to the console and clickable links as if it's part of the CLI's output.