Zennoxa

We resolved the dependency trees of 34 of the most-used npm packages (484 packages). Under 1% run install scripts, but only 21.5% publish build provenance: 78.5% ship with no verifiable link from the package you install back to the source and CI that built it. Scripts and data are published. #npm #supplychain #provenance https://zennoxa.com/research/npm-provenance-census-2026

Checked 25 popular infra/app repos. Of the 16 with a clear primary image, 8 (50.0%) ship a final stage with no non-root USER line. Half of the images developers actually pull. Method and per-file data in the study. #containers #docker #appsec https://zennoxa.com/research/container-root-user-2026

Vulnerability advisories entering the public record over 5 years: PHP 6.6x, Java 4.8x, .NET 4.2x, Rust 3.0x, Python 2.3x. The count of catalogued open-source scanning tools per language stayed flat. For Rust that is up to 157 new advisories per open-source tool per year. #infosec #opensource #sca https://zennoxa.com/research/advisory-growth-vs-tooling-coverage-2026