Andy Svintsitsky

PowerShell module assessments that assume the Gallery is hostile.
Because sometimes it is.
CTO @exelegent

[Andy Svintsitsky @AndySvints]

#StandWithUkraineNOW

[Mykhailo Fedorov @FedorovMykhailo]

We are creating an IT army. We need digital talents. All operational tasks will be given here: https://t.co/Ie4ESfxoSn. There will be tasks for everyone. We continue to fight on the cyber front. The first task is on the channel for cyber specialists.

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #42: MetaNull.PSGitOps

• clone/import and inspect Git repositories
• sync repositories with their remotes
• get and switch the current branch
• update a branch from its remote

Integrate Git operations into PowerShell-driven CI/CD workflows.

https://t.co/2OK56KSjq3

Maintained by @metanull

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #41: Notion

PowerShell-native ways to:
• create and manage Notion pages
• work with databases & properties
• create blocks including headings, code, images, callouts, bookmarks etc
• retrieve page & block content

What if your next Notion automation could be written entirely in PowerShell?

https://t.co/u8dScIuOKv

Maintained by https://t.co/X2WqL72mCT

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #40: IntuneQL

• interactive query builder & built-in Intune queries
• export to CSV, JSON, PowerShell, and cURL
• device remediation actions

Complete terminal workspace for Microsoft Intune admins.

https://t.co/u8dScIuOKv

Maintained by @ugurkocde

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #39: PSCumulus

• Connecting to cloud providers
• Browsing compute, storage, networking, and regions
• Searching resources across clouds

Unified PowerShell experience across Azure, AWS & GCP.

https://t.co/izOoylzVmv

Maintained by @adilio

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #38: pwsh-prompt

• Input validation
• Choice dialogs & Multi-select lists
• Rich keyboard navigation

Build better CLIs without reinventing the interaction layer every time.

https://t.co/47M2if9rXU

Maintained by David Freer (https://t.co/w3jgWFkoGj)

[Andy Svintsitsky @AndySvints]

Cybersecurity Wiretap #126: From Fake Tax Alerts to Self-Rewriting Malware with a Focus on AI-Powered Threats (week of 09/14/2026)

https://t.co/yjwdV7kxF7

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #37: PSModuleBrowser

• Search thousands of modules
• Preview commands before installing
• Install modules without leaving your terminal

Sometimes the best UI is still the terminal.

https://t.co/eI5HHET9ML

Maintained by Jorge Suarez (https://t.co/7iXfsph4y2 )

[Andy Svintsitsky @AndySvints]

Cybersecurity Wiretap #125: From ClickFix to Rogue RMM with a Focus on Weaponizing Trusted Tools (week of 09/07/2026) – AndySvints https://t.co/siB20JeQmC

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #36: StrictAclTools

• Audit file and folder ACLs
• Reset inherited permissions
• Apply deterministic, least-privilege ACLs

A useful addition to any Windows administrator's toolbox.

https://t.co/yHjH2sFRul

Maintained by DJStompZone (https://t.co/Ex2jpS0omP)

[Andy Svintsitsky @AndySvints]

Cybersecurity Wiretap #124: From Voice Phishing to Worm-Like RMM Activity with a Focus on AI Tool Abuse (week of 08/31/2026)

https://t.co/WArmF1txvO

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #35: LdapDrive

• Browse LDAP directories as if they were a native PowerShell drive
• Navigate with familiar commands like cd, dir, cat, mkdir & del instead of writing LDAP queries
• Search, edit attributes, browse schemas & perform bulk updates with full pipeline support

A fresh PowerShell-native approach to working with LDAP & Active Directory.

https://t.co/E8YJcPVSL8

Maintained by yotsuda (https://t.co/8h3APaiAQn)

[Andy Svintsitsky @AndySvints]

Cybersecurity Wiretap #123: From Fake GTA 6 Downloads to Agentic AI with a Focus on the Expanding AI Attack Surface (week of 08/24/2026)

https://t.co/DCXGt9FpXN

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #34: PowerLiquid

• Parse, render & analyze Liquid templates entirely from PowerShell
• Supports custom filters, tags, multiple Liquid dialects & AST generation for advanced scenarios
• Great for generating config files, documentation and other templated content

Bring one of the world's most popular templating engines directly into PowerShell automation.

https://t.co/ZkSZd2k5Z6

Maintained by PaulDash (https://t.co/WVLOwWlZEA )

[Andy Svintsitsky @AndySvints]

Cybersecurity Wiretap #122: From MFA Bypass to Agentic AI with a focus on Crypto Scams and GitHub C2 (week of 08/17/2026)

https://t.co/7dDu8HdZ2h

[Ryan - building & breaking & jumping around @ryanyates1990]

this was also pushed to #PowerShell @ThePSGallery

How do I know, well the same IP Address was used - http://193.70.34.101:20099/vote in the 1943 packages uploaded

I reported the packages to the PowerShell Team

https://t.co/v8RVIcfsgb

Trying to workout who/how to prod to update that article

[Andy Svintsitsky @AndySvints]

@ryanyates1990 @MJECloud Found even more modules
https://t.co/xB3OuEZNl9

[Andy Svintsitsky @AndySvints]

@PoSHYoungTeam Initial impact was grossly underestimated...
What looked like 200 malicious/typosquatted PowerShell Gallery modules is actually 1,943 modules tied to the same campaign.
https://t.co/3CMgcpXxh6

[Andy Svintsitsky @AndySvints]

@PoSHYoungTeam Initial impact was grossly underestimated...
What looked like 200 malicious/typosquatted PowerShell Gallery modules is actually 1,943 modules tied to the same campaign.
https://t.co/3CMgcpXxh6

[Andy Svintsitsky @AndySvints]

Found 200 related PSGallery packages: https://t.co/JCTb9ZDjMW
They beacon platform info to "193.70.34.101:20099/vote" and pulled main.exe from now-deleted GitHub repo (https://t.co/2pGy3gfYms - Malicious URL)

They appear unlisted, not deleted.

Please file Gallery abuse reports so they can be fully removed.

[Andy Svintsitsky @AndySvints]

Weekly PowerShell Module Spotlight #33: VerifyEncoding

• Verify text files use consistent UTF-8 encoding and Unix (LF) line endings
• Automatically detect and optionally fix encoding issues across Git repositories
• Perfect for CI/CD pipelines to prevent formatting-related build failures and noisy pull requests.

Big quality-of-life improvement for every PowerShell project.

https://t.co/huUYnevM6K

Maintained by ForNeVeR (https://t.co/TzhjLPytHp )

[Andy Svintsitsky @AndySvints]

@ryanyates1990 @MJECloud Found 200 related PSGallery packages: https://t.co/HwPQkVes5M

They appear unlisted, not deleted.