"Pick one stack, get good at it, the bugs start showing up fast."
NPX's Hunting Strategy
When picking a package to audit, I look for this specific combination:
- Decent install numbers (popular enough to be used).
- Last commit two or three years ago (abandoned by the original author).
- It does something scary like file uploads, auth, deserialization or shelling out.
"That combo hits more often than it has any right to."
1. Language Registries
JS / TS · The largest package registry in the world.
Explore →
Python · The official repository for Python packages.
Explore →
PHP · The main repository for Composer packages.
Explore →
Ruby · The official gem repository for Ruby libraries.
Explore →
Rust · The official package registry for the Rust language.
Explore →
Go · The official package discovery site for Go.
Explore →
Java, Kotlin, Scala · The central repository for Java artifacts.
Explore →
C# / .NET · The package manager for the Microsoft development platform.
Explore →
2. CMS & Web App Plugins
PHP · Plugins & Themes. The most popular target for first CVEs.
Explore →
PHP · Extensions. A rich ecosystem with a history of vulnerabilities.
Explore →
PHP · Extensions. Big in German and Dutch corporate land.
Explore →
PHP · Marketplace. Hosting billing panels.
Explore →
PHP · Adobe Commerce Marketplace. Huge e-commerce platform.
Explore →
3. CI/CD, DevOps & Infrastructure
YAML, Node, Docker · A bug here can mean code exec on build machines.
Explore →
Java · Plugins. Still ridiculously productive after all these years.
Explore →
Python, YAML · Roles and collections for automation.
Explore →
Images · Leaked secrets in layers, everything running as root.
Explore →
4. Browser, Editor & Desktop Extensions
JS · Extensions that run in millions of browsers.
Explore →
TypeScript · Plugins for the most popular code editor.
Explore →
Quick Start: Pick Your Stack
| Language / Tech |
Where to Start |
| PHP | WordPress, Joomla, TYPO3, WHMCS, Magento |
| Python | PyPI, Odoo, Splunkbase, HACS, Ansible |
| JS / TS | npm, Browser Extensions, VS Code, Backstage |
| Java | Jenkins, Maven Central, Atlassian, JetBrains |
| Rust / C | crates.io, Conan, PECL, OpenWrt |
| .NET | NuGet, Umbraco |
NIGHT PULSE X