Hedgerow-dev released Rowan, an open-source static application security testing (SAST) scanner for AI and ML projects, installable via `pipx install "rowan-sast[js-crossfile]"` on Python 3.10+. Rowan …
A developer argues that AI coding assistants, agents, and model stacks are accelerating software supply-chain risk by introducing untrusted packages, hallucinated dependency names, and unattended inst…
A developer discovered that an AI-generated LinkedIn account, "GyaanSetu AI (Artificial Intelligence)," had published a first-person post impersonating them and their npm package @bananacool467/ui-too…
An Apify Actor built around a GitHub MCP connector successfully identified 16 dependency advisories in a fixture repository without modifying code. The Actor, which can only read manifests, search iss…
A developer building a tool to verify claims in bug reports fabricated a security report against one of their own projects, inventing a CVE number that turned out to be a real Linux kernel vulnerabili…
A developer found that npm package existence checks are no longer effective against AI-hallucinated package names, which are being registered by attackers in a practice called 'slopsquatting'. The dev…
Coding agents that install dependencies at machine speed make registry-side vulnerability checks and install blocking a critical choke point, according to Omniline's blog. The article argues that huma…
A developer created VulnGraph, a deterministic vulnerability oracle for AI coding agents that turns continuously changing vulnerability intelligence into verified, content-addressed snapshots. The too…
A developer built RepoSense, a terminal-based GitHub intelligence tool that answers questions about any public repository in under 10 seconds using a single command. The tool leverages Coral SQL to qu…
Avai, an open-source host telemetry tool that uses large language models to classify threats, has been released. The tool snapshots 26 system corners on macOS and 21 on Linux, enriches findings with u…
The OWASP-backed CVE Lite CLI, a JavaScript and TypeScript dependency vulnerability scanner, analyzes local lockfiles to alert developers to security risks during coding rather than after a CI pipelin…