A developer building a tool to verify claims in bug reports fabricated a security report against one of their own projects, inventing a CVE number that turned out to be a real Linux kernel vulnerabili…
A developer found that npm package existence checks are no longer effective against AI-hallucinated package names, which are being registered by attackers in a practice called 'slopsquatting'. The dev…
Coding agents that install dependencies at machine speed make registry-side vulnerability checks and install blocking a critical choke point, according to Omniline's blog. The article argues that huma…
A developer created VulnGraph, a deterministic vulnerability oracle for AI coding agents that turns continuously changing vulnerability intelligence into verified, content-addressed snapshots. The too…
A developer built RepoSense, a terminal-based GitHub intelligence tool that answers questions about any public repository in under 10 seconds using a single command. The tool leverages Coral SQL to qu…
Avai, an open-source host telemetry tool that uses large language models to classify threats, has been released. The tool snapshots 26 system corners on macOS and 21 on Linux, enriches findings with u…
The OWASP-backed CVE Lite CLI, a JavaScript and TypeScript dependency vulnerability scanner, analyzes local lockfiles to alert developers to security risks during coding rather than after a CI pipelin…