In this session, we will be discussing two of our prominent tools that have emerged from extensive research and development in the cybersecurity space - Seekrets and our open-source NPM Account Takeover Detector. The leakage of secrets in code or packages is another critical security concern. When sensitive information, such as private keys or credentials, is exposed in code, it can lead to unauthorized access to systems, data breaches, or the compromise of entire applications. This type of vulnerability can have long-lasting consequences, including financial losses and damage to customer trust. Seekrets is a secret scanning tool that we have developed to help organizations safeguard their codebases. During our previous research, we identified a serious problem, secrets like private API tokens, passwords, and other sensitive information being leaked within popular programming languages and platforms like NPM, JS, Ruby, and WordPress. This issue was a focal point of our talks at prestigious conferences such as Black Hat, HITB, and MCTTP. Seekrets was created to help tackle this issue by scanning codebases for over 33 different types of secrets leakages. The tool can scan any NPM package, codebase in a ZIP file, or package.json for sensitive data exposure. We will showcase the tool's functionality, share our research stats, and discuss its practical benefits. Our open-source NPM account takeover detector on the other hand is a tool designed to address vulnerabilities in the NPM ecosystem. We've worked extensively on identifying and mitigating NPM account takeover risks, which were featured at major conferences like Black Hat. This tool is built to integrate into CI/CD pipelines, allowing developers to check whether the NPM packages they're using are vulnerable to account takeover. The open-source nature of the tool ensures it is freely available for anyone to use, making it an accessible solution to this pressing issue. During the presentation, we'll demonstrate how the tool works, the problem it addresses, and provide insights from our research. The impact of NPM account takeover through domain expiration can be significant. A domain expiration allows attackers to gain control over a package’s publishing rights, leading to potential malicious code injections, which can harm both developers and users relying on these packages. This can cause data breaches, loss of reputation, and widespread exploitation of the affected software.