A series of unfortunate agents.
Andrew Nesbitt
• Andrew Nesbitt
Incident Report: CVE-2026-LGTM
Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.
- Author
- Andrew Nesbitt
- Generator
- Jekyll
- Public lists
- davewiner/hackerNewsStars
- Fetched
Andrew Nesbitt
• Andrew Nesbitt
Scrutineer: scanning open source without flooding maintainers
Finding the vulnerabilities is the easy part
Andrew Nesbitt
• Andrew Nesbitt
Sunsetting a Package Manager
A frozen registry is the one place a package can never be patched again.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 20 June 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Open Source vs the Invisible Hand
Ten million downloads a week, one maintainer, zero dollars.
Andrew Nesbitt
• Andrew Nesbitt
How Open Source Projects Change Hands
There are fewer ways to leave your package than to kill it.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 13 June 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Joint Guidance on Vulnerability Naming and Disclosure
Every named CVE now ships with a single-page site at .vuln.
Andrew Nesbitt
• Andrew Nesbitt
What Happened to tea.xyz
Reading the tea leaves
Andrew Nesbitt
• Andrew Nesbitt
Forms of Open Source Government
Open source has more forms of government than countries do.
Andrew Nesbitt
• Andrew Nesbitt
Package Manager Patents
A reference list of patents and applications relevant to package manager design, with notes on prior art.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 6 June 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Install-script allowlists
A survey of install-script allowlist mechanisms across package managers and language ecosystems.
Andrew Nesbitt
• Andrew Nesbitt
gittuf - a signed log for git refs
Branch protection is a row in someone else's database
Andrew Nesbitt
• Andrew Nesbitt
Skills Registry Threat Models
How long until we see a CVE filed against a markdown file?
Andrew Nesbitt
• Andrew Nesbitt
The Infosec Phrasebook
a/s/l/threat model?
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 30 May 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Composer’s dependency policies
uBlock Origin for composer install
Andrew Nesbitt
• Andrew Nesbitt
Protestware for coding agents
printMessageForCodingAgents()
Andrew Nesbitt
• Andrew Nesbitt
Package managers that package package managers
brew install pip install poetry add pdm add uv tool install conda
Andrew Nesbitt
• Andrew Nesbitt
CHAOSS Metrics in 2026
CHAOSS metrics were calibrated for human-speed contribution
Andrew Nesbitt
• Andrew Nesbitt
GitHub Actions security in Python packages
Thank you Dr. Zizmor
Andrew Nesbitt
• Andrew Nesbitt
Signing is for the bad days
TUF, in-toto, and Sigstore only look pointless while nothing is on fire
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 23 May 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Dependency Pruning
A survey of unused-dependency detectors
Andrew Nesbitt
• Andrew Nesbitt
RFC: Artificial Contributors to Open Source
Intended status: Best Current Practice.
Andrew Nesbitt
• Andrew Nesbitt
Dumb Ways for an Open Source Project to Die
How your dependencies became Bernies
Andrew Nesbitt
• Andrew Nesbitt
Language Registries Are Unstable by Default
apt install -t unstable, but make it your whole personality
Andrew Nesbitt
• Andrew Nesbitt
Centrality is not vitality
Don't automatically reach for PageRank on dependency graphs
Andrew Nesbitt
• Andrew Nesbitt
Showing Our Work
An independent benchmark of the ecosyste.ms Python fund