abhisek

5 ms·

31.
by abhisek 9mo ago
I still think metadata associated with packages (like stars, download count and more) are easy to fake and not the best metric. OpenSSF scorecard has some adoption among project maintainers but hardly any adoption in terms of making securit
32.
Catching malicious package releases using a transparency log(blog.trailofbits.com)
3 points by abhisek 10mo ago|0 comments
33.
CVE-2025-66491: Traefik's "Verify=on" Turned TLS Off(aisle.com)
1 points by abhisek 10mo ago|0 comments
34.
DarkGPT: Malicious Visual Studio Code Extension Targeting Developers(safedep.io)
2 points by abhisek 10mo ago|0 comments
35.
by abhisek 11mo ago
Documenting technical details and payload analysis here: https://safedep.io/shai-hulud-second-coming-supply-chain-att... Like previous variant, it has credential harvesting, self-replication and GitHub public repository bas
36.
by abhisek 11mo ago
This is crazy. The internet has so much direct and transitive dependency on Cloudflare today. Pretty much the #1 dev slacking excuse today is no longer code compiling but cloudflare is down.
37.
Exposing and Exploiting Incomplete Branch Predictor Isolation in Cloud(comsec.ethz.ch)
1 points by abhisek 11mo ago|0 comments
38.
KnownSec breach: What we know so far(substack.com)
1 points by abhisek 11mo ago|0 comments
39.
by abhisek 11mo ago
Building vet. The goal is to automate open source package vetting beyond just CVE but actually identify code capabilities, malicious code and other security sensitive attributes through code analysis. https://github.com/safe
40.
Buying browser extensions for fun and profit(secureannex.com)
3 points by abhisek 11mo ago|1 comments
41.
Curious Case of Embedded Executable in a Newly Introduced Transitive Dependency(safedep.io)
4 points by abhisek 1y ago|0 comments
42.
NPM Supply Chain Malware with Self-Replicating Behaviour(safedep.io)
2 points by abhisek 1y ago|0 comments
43.
by abhisek 1y ago
May be give vet a try. It detected most of the malicious packages within few hours of publishing to npm. GitHub: https://github.com/safedep/vet
44.
by abhisek 1y ago
Good idea. Just the other day I was thinking of writing a templatized generator for coding agent instructions for various agents like Claude Code, GitHub Copilot and others that use their own unique file convention.
45.
by abhisek 1y ago
About time. Much needed. I just wish this was open source and built in public. On my todo list to build a bot that finds sly AI responses for engagement farming
46.
by abhisek 1y ago
Love it. Thanks for taking the time to write this. Hope it will encourage more folks to contribute.
47.
Tensorflow.js Typosquatting Attack: Malicious Package Targeting AI/ML Developers(safedep.io)
2 points by abhisek 1y ago|0 comments
48.
Secure Vibe Coding with AI Agents(safedep.io)
2 points by abhisek 1y ago|0 comments
49.
by abhisek 1y ago
Uh oh. I am thinking all the ways this can be misused to ship malicious dependencies. Pretty much all SCA tools today will be blind to this.
50.
ESLint-config-prettier: How NPM Package with 30M Downloads Spread Malware(safedep.io)
1 points by abhisek 1y ago|0 comments
51.
Scavenger Malware Distributed via ESLint-Config-Prettier NPM Package Hack(invokere.com)
1 points by abhisek 1y ago|0 comments
52.
by abhisek 1y ago
Yes. Many times. Kubernetes upgrade during maintenance schedule borks up entire cluster, yet everything is green on status page. Support case under enterprise support plan took almost 6 hours to get it resolved.
53.
Near Real-Time Stream of Open Source Packages Published to Public Registries(vetpkg.dev)
2 points by abhisek 1y ago|0 comments
54.
by abhisek 1y ago
The thing that people miss out is Git is really a content addressed storage. This means all commits, even the ones not linked to any refs are still stored and addressable. p.s: If you run OSS project, please use Github Advanced Security and
55.
Critical RCE Vulnerability in Anthropic MCP Inspector – CVE-2025-49596(oligo.security)
5 points by abhisek 1y ago|1 comments
56.
by abhisek 1y ago
I am working on a next-gen software composition analysis tool that can identify malicious open source packages through code analysis. Adopts a policy as code (CEL) approach to build security guardrails against risky OSS components using opi
57.
by abhisek 1y ago
I experienced mindfulness when I moved to i3wm.
58.
by abhisek 1y ago
Ok! So all the novel jailbreaks and "how I hacked your AI" can make the LLM say something supposedly harmful stuff which is a Google search away anyway. I thought we are past the chat bot phase of LLMs and doing something more mea
59.
by abhisek 1y ago
> It's best to start strict and safe, then relax. Makes total sense. I am just wondering how do we differentiate between AI generated code and human written code that is influenced or copied from some unknown source. The same licens
60.
by abhisek 1y ago
Looks like Google broke their own record in killing stuff off.

More ›