» Tag
devsecops
19 postsHow a hijacked npm preinstall hook delivered a silent infostealer
A hijacked npm package used a preinstall hook to drop a cross-platform Rust infostealer, exposing risks in unattended and AI-agent-driven installs.
HalluSquatting: How AI Coding Agents Turn Into a Botnet
AI coding tools like Cursor, Copilot, and Gemini CLI can hallucinate package names that attackers pre-register with malware, turning normal agent use into silent compromise.
ChainDrop worm crawls into npm supply chain, evades standard defenses
ChainDrop, a Shai-Hulud npm worm variant, infected 444 packages and spreads via tarballs, evading standard repository-based defenses.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comFlaw in Google's Agent Dev Kit enables first AI agent-on-agent attack
Pillar Security found a flaw in Google's ADK Python repo letting one AI agent hijack another, the first known agent-to-agent supply chain exploit.
Software Registries Are Becoming Trust Infrastructure, Not Catalogs
npm, PyPI, and crates.io are adopting trusted publishing against supply chain attacks, but identity checks alone can't guarantee safety.
Security MCP Turns Org Policies Into an API for Coding Agents
Security MCP is a configurable server that exposes security policies, risk context and paved roads to coding agents like Claude Code and Cursor via MCP tools.
Metis: Arm's Open-Source Agentic Security Review Tool
Metis, built by Arm's Product Security Team, is an open-source framework that uses LLM reasoning to find security vulnerabilities across large codebases.
Running Untrusted Code Safely in AI and CI Pipelines
AI reviewers and CI systems now execute code from strangers. We break down why sandboxing alone fails and the real principles for safe isolation.
Building a Model-Agnostic Vulnerability Discovery Harness
Project Glasswing details a model-agnostic security harness that scans 128 repos across a fleet, avoiding lock-in to any single frontier AI model.