Preliminary research

Hack the Source, Of the Source

Tsi-Lin Ng

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

A talk on hacking package registries by chaining parser differentials with injection. A LuaJIT-vs-Lua integer differential makes server and client resolve different versions; Julia's Registrator falls to command and argument injection via git rev-parse and clone --upload-pack, reached via a backslash API path traversal returning a controlled clone_url for RCE; a NuGet nuspec-selection inconsistency poisons the registration blob; and CocoaPods session tokens fall to a birthday attack.

Record

Researcher

Tsi-Lin Ng

Format

Whitepaper

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Born Corrupted

Tags

• supply-chain
• parser-differential
• command-injection
• path-traversal
• rce
• ssrf
• dotnet
• go
• attack-chain
• owasp-a01-2021
• owasp-a03-2021
• owasp-a06-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Tsi-Lin Ng, first published at the original source. Preserved copies are kept so the citation survives its host.