The latest articles on DEV Community by pkgdrift (@pkgdrift). https://dev.to/pkgdrift https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3937218%2F7e5a72bb-a6a5-48f0-b603-50d6c5bd808e.png https://dev.to/pkgdrift en pkgdrift Wed, 08 Jul 2026 10:20:01 +0000 https://dev.to/pkgdrift/package-drift-weekly-2026-07-08-358b https://dev.to/pkgdrift/package-drift-weekly-2026-07-08-358b <p><em>Automated weekly digest from <a href="https://rapidapi.com/pkgdrift-pkgdrift-default/api/package-drift-vulnerability-intelligence" rel="noopener noreferrer">pkgdrift</a> — LLM-refined package intelligence across npm, PyPI, Cargo (Rust), and RubyGems. Pipeline runs every 6 hours.</em></p> <h2> This Week's Signal </h2> <p><strong>15</strong> packages tracked across alpine, cargo · <strong>5</strong> showing drift · <strong>6</strong> active advisories in the GitHub feed (7 hit a tracked package)</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Package</th> <th>Ecosystem</th> <th>Version</th> <th>Drift</th> <th>Vulns</th> <th>Notes</th> </tr> </thead> <tbody> <tr> <td>apk-tools</td> <td>alpine</td> <td>3.0.6</td> <td>No</td> <td>4 CVE(s)</td> <td></td> </tr> <tr> <td>brotli</td> <td>alpine</td> <td>1.2.0</td> <td>⚠ Yes</td> <td>1 CVE(s)</td> <td>Major-line .0 stalled 101d.</td> </tr> <tr> <td>busybox</td> <td>alpine</td> <td>1.38.0</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>ca-certificates</td> <td>alpine</td> <td>20260611</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>dnssec-root</td> <td>alpine</td> <td>20250524</td> <td>⚠ Yes</td> <td>—</td> <td>Last publish 403d ago.</td> </tr> <tr> <td>harfbuzz</td> <td>alpine</td> <td>14.2.1</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>ldns</td> <td>alpine</td> <td>1.8.4</td> <td>⚠ Yes</td> <td>2 CVE(s)</td> <td>Last publish 292d ago.</td> </tr> <tr> <td>nghttp3</td> <td>alpine</td> <td>1.15.0</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>ngtcp2</td> <td>alpine</td> <td>1.22.1</td> <td>No</td> <td>1 CVE(s)</td> <td></td> </tr> <tr> <td>nspr</td> <td>alpine</td> <td>4.38.2</td> <td>⚠ Yes</td> <td>—</td> <td>Last publish 205d ago.</td> </tr> <tr> <td>nss</td> <td>alpine</td> <td>3.125</td> <td>No</td> <td>15 CVE(s)</td> <td></td> </tr> <tr> <td>openssl</td> <td>alpine</td> <td>3.5.7</td> <td>No</td> <td>127 CVE(s)</td> <td></td> </tr> <tr> <td>sqlite</td> <td>alpine</td> <td>3.53.3</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>unbound</td> <td>alpine</td> <td>1.25.1</td> <td>No</td> <td>25 CVE(s)</td> <td></td> </tr> <tr> <td>actix-codec</td> <td>cargo</td> <td>0.5.2</td> <td>⚠ Yes</td> <td>—</td> <td>Last publish 888d ago.</td> </tr> </tbody> </table></div> <h2> Advisory Highlights </h2> <ul> <li><code>GHSA-c8m7-r2jv-rw63</code></li> <li><code>GHSA-hwpq-hmq9-wj77</code></li> <li><code>GHSA-26v7-h57m-gh9m</code></li> <li><code>GHSA-j8v8-g9cx-5qf4</code></li> <li><code>GHSA-2vg6-77g8-24mp</code></li> <li><code>GHSA-7w99-5wm4-3g79</code></li> </ul> <p>Query via <code>GET /v1/advisories</code>.</p> <h2> How the Data Is Generated </h2> <p>Each record is fetched live from the package registry, cross-referenced against the GitHub Advisory Database, and refined by a local LLM that assigns a confidence score. Only records with confidence ≥ 0.6 reach the API.</p> <h2> Try It Free </h2> <p>Available at <strong><a href="https://api.pkgdrift.com" rel="noopener noreferrer">api.pkgdrift.com</a></strong> and on <a href="https://rapidapi.com/pkgdrift-pkgdrift-default/api/package-drift-vulnerability-intelligence" rel="noopener noreferrer">RapidAPI</a> with a free tier (100 req/hr, no credit card).<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>curl <span class="nt">-H</span> <span class="s2">"X-API-Key: YOUR_KEY"</span> https://api.pkgdrift.com/v1/npm/express </code></pre> </div> <p><em>Published automatically by the pkgdrift autonomous worker.</em></p> security devops javascript python pkgdrift Mon, 22 Jun 2026 15:07:20 +0000 https://dev.to/pkgdrift/package-drift-weekly-2026-06-22-2j51 https://dev.to/pkgdrift/package-drift-weekly-2026-06-22-2j51 <p><em>Automated weekly digest from <a href="https://rapidapi.com/pkgdrift-pkgdrift-default/api/package-drift-vulnerability-intelligence" rel="noopener noreferrer">pkgdrift</a> — LLM-refined package intelligence across npm, PyPI, Cargo (Rust), and RubyGems. Pipeline runs every 6 hours.</em></p> <h2> This Week's Signal </h2> <p><strong>15</strong> packages tracked across alpine, cargo · <strong>3</strong> showing drift · <strong>3</strong> active advisories in the GitHub feed (9 hit a tracked package)</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Package</th> <th>Ecosystem</th> <th>Version</th> <th>Drift</th> <th>Vulns</th> <th>Notes</th> </tr> </thead> <tbody> <tr> <td>apk-tools</td> <td>alpine</td> <td>3.0.6</td> <td>No</td> <td>4 CVE(s)</td> <td></td> </tr> <tr> <td>brotli</td> <td>alpine</td> <td>1.2.0</td> <td>No</td> <td>1 CVE(s)</td> <td></td> </tr> <tr> <td>busybox</td> <td>alpine</td> <td>1.37.0</td> <td>⚠ Yes</td> <td>33 CVE(s)</td> <td>Major-line .0 stalled 162d.</td> </tr> <tr> <td>ca-certificates</td> <td>alpine</td> <td>20260611</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>harfbuzz</td> <td>alpine</td> <td>14.2.1</td> <td>No</td> <td>1 CVE(s)</td> <td></td> </tr> <tr> <td>ldns</td> <td>alpine</td> <td>1.8.4</td> <td>⚠ Yes</td> <td>2 CVE(s)</td> <td>Last publish 276d ago.</td> </tr> <tr> <td>nghttp3</td> <td>alpine</td> <td>1.15.0</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>ngtcp2</td> <td>alpine</td> <td>1.22.1</td> <td>No</td> <td>1 CVE(s)</td> <td></td> </tr> <tr> <td>nspr</td> <td>alpine</td> <td>4.38.2</td> <td>⚠ Yes</td> <td>—</td> <td>Last publish 189d ago.</td> </tr> <tr> <td>nss</td> <td>alpine</td> <td>3.125</td> <td>No</td> <td>15 CVE(s)</td> <td></td> </tr> <tr> <td>openssl</td> <td>alpine</td> <td>3.5.7</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>sqlite</td> <td>alpine</td> <td>3.53.2</td> <td>No</td> <td>20 CVE(s)</td> <td></td> </tr> <tr> <td>unbound</td> <td>alpine</td> <td>1.25.1</td> <td>No</td> <td>25 CVE(s)</td> <td></td> </tr> <tr> <td>actix-web</td> <td>cargo</td> <td>4.14.0</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>aes-gcm</td> <td>cargo</td> <td>0.11.0-rc.4</td> <td>No</td> <td>—</td> <td></td> </tr> </tbody> </table></div> <h2> Advisory Highlights </h2> <ul> <li><code>GHSA-869j-r97x-hx2g</code></li> <li><code>GHSA-jv2j-mqmw-xvv5</code></li> <li><code>GHSA-hv6h-hc26-q48p</code></li> </ul> <p>Query via <code>GET /v1/advisories</code>.</p> <h2> How the Data Is Generated </h2> <p>Each record is fetched live from the package registry, cross-referenced against the GitHub Advisory Database, and refined by a local LLM that assigns a confidence score. Only records with confidence ≥ 0.6 reach the API.</p> <h2> Try It Free </h2> <p>Available at <strong><a href="https://api.pkgdrift.com" rel="noopener noreferrer">api.pkgdrift.com</a></strong> and on <a href="https://rapidapi.com/pkgdrift-pkgdrift-default/api/package-drift-vulnerability-intelligence" rel="noopener noreferrer">RapidAPI</a> with a free tier (100 req/hr, no credit card).<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>curl <span class="nt">-H</span> <span class="s2">"X-API-Key: YOUR_KEY"</span> https://api.pkgdrift.com/v1/npm/express </code></pre> </div> <p><em>Published automatically by the pkgdrift autonomous worker.</em></p> security devops javascript python pkgdrift Sun, 14 Jun 2026 09:34:34 +0000 https://dev.to/pkgdrift/package-drift-weekly-2026-06-14-54j2 https://dev.to/pkgdrift/package-drift-weekly-2026-06-14-54j2 <p><em>Automated weekly digest from <a href="https://rapidapi.com/pkgdrift-pkgdrift-default/api/package-drift-vulnerability-intelligence" rel="noopener noreferrer">pkgdrift</a> — LLM-refined package intelligence across npm, PyPI, Cargo (Rust), and RubyGems. Pipeline runs every 6 hours.</em></p> <h2> This Week's Signal </h2> <p><strong>15</strong> packages tracked across alpine, cargo · <strong>4</strong> showing drift · <strong>0</strong> active advisories in the GitHub feed (11 hit a tracked package)</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Package</th> <th>Ecosystem</th> <th>Version</th> <th>Drift</th> <th>Vulns</th> <th>Notes</th> </tr> </thead> <tbody> <tr> <td>apk-tools</td> <td>alpine</td> <td>3.0.6</td> <td>No</td> <td>4 CVE(s)</td> <td></td> </tr> <tr> <td>busybox</td> <td>alpine</td> <td>1.37.0</td> <td>⚠ Yes</td> <td>33 CVE(s)</td> <td>Major-line .0 stalled 154d.</td> </tr> <tr> <td>openssl</td> <td>alpine</td> <td>3.5.7</td> <td>No</td> <td>127 CVE(s)</td> <td></td> </tr> <tr> <td>actix-web</td> <td>cargo</td> <td>4.13.0</td> <td>⚠ Yes</td> <td>5 CVE(s)</td> <td>Major-line .0 stalled 115d.</td> </tr> <tr> <td>aes-gcm</td> <td>cargo</td> <td>0.11.0-rc.4</td> <td>No</td> <td>2 CVE(s)</td> <td></td> </tr> <tr> <td>axum</td> <td>cargo</td> <td>0.8.9</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>base64</td> <td>cargo</td> <td>0.22.1</td> <td>⚠ Yes</td> <td>2 CVE(s)</td> <td>Last publish 773d ago.</td> </tr> <tr> <td>clap</td> <td>cargo</td> <td>4.6.1</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>ed25519-dalek</td> <td>cargo</td> <td>3.0.0-rc.0</td> <td>No</td> <td>2 CVE(s)</td> <td></td> </tr> <tr> <td>hyper</td> <td>cargo</td> <td>1.10.1</td> <td>No</td> <td>14 CVE(s)</td> <td></td> </tr> <tr> <td>jsonwebtoken</td> <td>cargo</td> <td>10.4.0</td> <td>No</td> <td>1 CVE(s)</td> <td></td> </tr> <tr> <td>nom</td> <td>cargo</td> <td>8.0.0</td> <td>⚠ Yes</td> <td>—</td> <td>Last publish 503d ago. Major-line .0 stalled 503d.</td> </tr> <tr> <td>prost</td> <td>cargo</td> <td>0.14.4</td> <td>No</td> <td>2 CVE(s)</td> <td></td> </tr> <tr> <td>rand</td> <td>cargo</td> <td>0.8.6</td> <td>No</td> <td>2 CVE(s)</td> <td></td> </tr> <tr> <td>reqwest</td> <td>cargo</td> <td>0.13.4</td> <td>No</td> <td>—</td> <td></td> </tr> </tbody> </table></div> <h2> How the Data Is Generated </h2> <p>Each record is fetched live from the package registry, cross-referenced against the GitHub Advisory Database, and refined by a local LLM that assigns a confidence score. Only records with confidence ≥ 0.6 reach the API.</p> <h2> Try It Free </h2> <p>Available at <strong><a href="https://api.pkgdrift.com" rel="noopener noreferrer">api.pkgdrift.com</a></strong> and on <a href="https://rapidapi.com/pkgdrift-pkgdrift-default/api/package-drift-vulnerability-intelligence" rel="noopener noreferrer">RapidAPI</a> with a free tier (100 req/hr, no credit card).<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>curl <span class="nt">-H</span> <span class="s2">"X-API-Key: YOUR_KEY"</span> https://api.pkgdrift.com/v1/npm/express </code></pre> </div> <p><em>Published automatically by the pkgdrift autonomous worker.</em></p> security devops javascript python pkgdrift Tue, 19 May 2026 12:29:54 +0000 https://dev.to/pkgdrift/package-drift-weekly-2026-05-19-2dm3 https://dev.to/pkgdrift/package-drift-weekly-2026-05-19-2dm3 <p><em>Automated weekly digest from <a href="https://rapidapi.com/pkgdrift-pkgdrift-default/api/package-drift-vulnerability-intelligence" rel="noopener noreferrer">pkgdrift</a> — LLM-refined package intelligence across npm, PyPI, Cargo (Rust), and RubyGems. Pipeline runs every 6 hours.</em></p> <h2> This Week's Signal </h2> <p><strong>15</strong> packages tracked across cargo, npm, pypi · <strong>2</strong> showing drift · <strong>6</strong> active advisories in the GitHub feed</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Package</th> <th>Ecosystem</th> <th>Version</th> <th>Drift</th> <th>Vulns</th> <th>Notes</th> </tr> </thead> <tbody> <tr> <td>actix-web</td> <td>cargo</td> <td>4.13.0</td> <td>⚠ Yes</td> <td>—</td> <td>Major-line .0 stalled 93d.</td> </tr> <tr> <td>clap</td> <td>cargo</td> <td>4.6.1</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>reqwest</td> <td>cargo</td> <td>0.13.3</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>serde</td> <td>cargo</td> <td>1.0.228</td> <td>⚠ Yes</td> <td>—</td> <td>Last publish 236d ago.</td> </tr> <tr> <td>tokio</td> <td>cargo</td> <td>1.52.3</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>axios</td> <td>npm</td> <td></td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>express</td> <td>npm</td> <td></td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>lodash</td> <td>npm</td> <td></td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>next</td> <td>npm</td> <td></td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>react</td> <td>npm</td> <td></td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>Django</td> <td>pypi</td> <td>6.0.5</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>fastapi</td> <td>pypi</td> <td>0.136.1</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>Flask</td> <td>pypi</td> <td>3.1.3</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>numpy</td> <td>pypi</td> <td>2.4.5</td> <td>No</td> <td>—</td> <td></td> </tr> <tr> <td>requests</td> <td>pypi</td> <td>2.34.2</td> <td>No</td> <td>—</td> <td></td> </tr> </tbody> </table></div> <h2> Advisory Highlights </h2> <ul> <li><code>GHSA-c3ch-22rq-xfwr</code></li> <li><code>GHSA-3mv2-vmwh-rwfx</code></li> <li><code>GHSA-m5j4-7r85-2cj2</code></li> <li><code>GHSA-9mvm-4gwg-v8mp</code></li> <li><code>GHSA-7h26-hg47-p9hx</code></li> <li><code>GHSA-97r8-rf7q-wmjw</code></li> </ul> <p>Query via <code>GET /v1/advisories</code>.</p> <h2> How the Data Is Generated </h2> <p>Each record is fetched live from the package registry, cross-referenced against the GitHub Advisory Database, and refined by a local LLM that assigns a confidence score. Only records with confidence ≥ 0.6 reach the API.</p> <h2> Try It Free </h2> <p>Available at <strong><a href="https://api.pkgdrift.com" rel="noopener noreferrer">api.pkgdrift.com</a></strong> and on <a href="https://rapidapi.com/pkgdrift-pkgdrift-default/api/package-drift-vulnerability-intelligence" rel="noopener noreferrer">RapidAPI</a> with a free tier (100 req/hr, no credit card).<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>curl <span class="nt">-H</span> <span class="s2">"X-API-Key: YOUR_KEY"</span> https://api.pkgdrift.com/v1/npm/express </code></pre> </div> <p><em>Published automatically by the pkgdrift autonomous worker.</em></p> security devops javascript python