🔍 Vulnerability Research

A curated collection of in-depth vulnerability writeups covering real-world security incidents in the software ecosystem. Each entry includes a full technical analysis, proof-of-concept, IOC listing, and remediation guidance.

Purpose: Educational reference and portfolio. All PoC code is for detection and research only.

Index

Structure

Each entry follows a consistent format:

axios-supply-chain-cve-2026-26555/
├── README.md             # Project overview
├── analysis.md           # Full writeup
└── references.md         # Cited sources
├── poc/                  # Detection & PoC scripts
    │ 
    ├── diff_axios.sh         # Package diff to verify phantom dependency
    │
    ├── scan_lockfile.sh      # IOC scanner for malicious axios versions
    │
    ├── postinstall_demo     # Safe postinstall hook demonstration
         │           
         ├── package.json
         │
         ├── setup.js

Methodology

The writeup covers:

• Root cause — what actually broke and how
• Attack timeline — pre-staging, execution, discovery, remediation
• Technical deep-dive — deobfuscated payloads, attack chain, IOCs
• PoC — reproduction or detection scripts
• Lessons learned — systemic issues and mitigations

Maintained by @horrister