Skip to main content

⚡ DNS is not just about domains. It is about Trust.

· 2 min read
Yevgeniy Goncharov
Yevgeniy Goncharov
Maintainer of OpenBLD.net

OpenBLD: DNS is not just about domains. It is about Trust.

Recent supply chain incidents are a strong reminder that modern attacks often start through tools and workflows developers already trust:

  • npm packages and dependency updates
  • compromised maintainer accounts
  • VSCode extensions
  • GitHub Actions workflows
  • developer tools
  • fake installers and update mechanisms

Several recent cases highlight this trend:

  • Axios compromised on npm — malicious versions dropped a Remote Access Trojan >
  • Compromised VSCode Nx Console >
  • OpenAI response to the TanStack npm supply chain attack >
  • OpenAI response to the Axios developer tool compromise >
  • GitHub reported an investigation into unauthorized access to internal repositories >

The key takeaway: supply chain attacks are becoming more relevant to every developer, engineering team, and company.

DNS security should not be treated as an optional layer.

It can provide visibility and control when malicious code attempts to:

  • connect to C2 infrastructure
  • download additional payloads
  • reach phishing domains
  • communicate with fake update servers
  • exfiltrate data through suspicious endpoints

If malicious code has already entered the environment, visibility becomes critical...

At this point, the key questions are simple:

  • Can you see where it is trying to connect?
  • Can you understand whether that connection is expected?
  • Can you react before the incident becomes bigger?

OpenBLD.net — Security starts earlier than incident response.

Watch yourself, your emails, your extensions, and your DNS.

Updates​