OX Security Blog

https://www.ox.security/blog/

Discovered via S1 2026-05-19 research. Published primary research on TeamPCP copycat npm packages (Shai-Hulud clones from deadcode09284814) on 2026-05-17 ahead of THN coverage; supply-chain attack early-detection. Candidate — promote to active after 3 runs with content contribution. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch (listing) https://www.ox.security/blog/ then webfetch per-article /blog/{slug}.. AVOID: Recent output is vendor thought-leadership/marketing (AI-prompt security, Gartner MQ promo) — don't expect the original supply-chain threat research the candidacy cited; verify each post is research before citing.. | 2026-07-05 admiralty audit: C — vendor blog, some original supply-chain detections but short track record and marketing-diluted; keep candidate, verify each post is research before citing. | 2026-07-26 weekly quality audit: promoted candidate → active on the documented lifecycle bar (cited by published entries from 3 distinct runs; the bar is 3). The promotion had never been executed because nothing counted contributing runs — the digest now emits sources.promotion_due (tools/run_summary.py).