Skip to main content
NewWhen the Malicious Hook Is in the Other Manifest: 700+ Repos, 8 Packagist Packages, One package.json Trick

Learn DevOps by doing,
not just reading.

590+ simulators, quizzes, and hands-on exercises for engineers who prefer a terminal over a slide deck.

Join 5,000+ DevOps engineers learning every week

kubectl --watch
$
devops-daily --stats

// featured

Interactive Simulators

Browse all simulators

// categories

Popular Categories

Explore our content by topic

// exercises

Hands-On Exercises

Practice real-world DevOps scenarios with step-by-step guidance

View all exercises

// quizzes

Test Your Knowledge

Short interactive quizzes across Docker, Kubernetes, Terraform, networking, and more

// posts

Latest Posts

Stay up to date with the latest DevOps content

DevOps

When the Malicious Hook Is in the Other Manifest: 700+ Repos, 8 Packagist Packages, One package.json Trick

On May 22, 2026, Socket disclosed a Composer supply chain attack that hid an npm-style postinstall command inside package.json on PHP projects. composer.json was clean, the PHP review missed it, and 700+ GitHub repos pulled it in. Here is the exact payload, why ecosystem-boundary blindness keeps catching teams, and how to wire your CI to look at both manifests.

|10 min read
DevOps

node-ipc DNS-Tunneling Supply Chain Attack: Your Egress Firewall Probably Missed This

On May 14, 2026, three malicious versions of the node-ipc npm package shipped a payload that hunts AWS, SSH, kubeconfig, and GitHub CLI credentials, then smuggles them out through DNS TXT queries. Most orgs filter HTTPS egress. Almost nobody filters DNS. Here is what the payload does and how to close the gap.

|11 min read
DevOps

AI Is Reshaping DevOps. The Engineers Are Faster Than the Vendors.

GitHub, Datadog, HashiCorp and friends are moving carefully. The engineers running their stacks are wiring AI into kubectl and pull-request review on a Tuesday afternoon. Here is what is actually changing in 2026, what is not, and where the gap between vendors and the engineers using their tools is widest.

|12 min read
DevOps

AntV npm Compromise: The Shai-Hulud Worm Comes for Your Dashboards (May 19, 2026)

A new Shai-Hulud wave landed at 01:56 UTC on May 19 and rode the @antv maintainer account through 323 packages including echarts-for-react. Here is what got published, what it steals, and the lockfile grep that tells you if you are exposed.

|9 min read
Kubernetes

Cilium 1.19 ClusterMesh Policy Flip: The Silent Default That Will Drop Your Cross-Cluster Traffic

Cilium 1.19 changed how network policies without a cluster selector resolve in a ClusterMesh. East/West traffic that 1.18 implicitly allowed is now silently dropped. Here is how to find every affected policy before you upgrade.

|11 min read
Kubernetes

Karpenter Spot Storm Fallback Gap: The Production Loop Nobody Talks About

When AWS spot capacity dries up in a region, Karpenter does not automatically fall back to on-demand. It retries the same dying offerings on a 3-minute loop. Here is why, and how to design around it.

|12 min read

// guides

Latest Guides

Step-by-step tutorials to boost your DevOps skills

// tools

DevOps Tools and Calculators

Free, browser-only utilities. CIDR, JWT, base64, UUID, cron, K8s sizing, YAML. No sign-up, no server.

// about

DevOps Daily is a free, independent education platform for engineers who want to learn by running things, not by reading pitch decks. Kubernetes, Docker, Terraform, CI/CD, observability, and security, through hands-on simulators, quizzes, exercises, and a weekly newsletter.

Free
$0
forever
Simulators
30+
interactive
Subscribers
5,000+
engineers
Cadence
Weekly
no spam
devops-daily --subscribe
$ echo "Weekly DevOps digest. No spam. Unsubscribe anytime."
Weekly DevOps digest. No spam. Unsubscribe anytime.
$ subscribe --email
$

5,000+ engineers subscribed