🚨Must Have🚨 - disable auto-updates for extensions in VS Code/Cursor + other forks (MacOS: Cmd + Shift + P -> "Disable Auto Updating Extensions") - use static analysis ( for GHA to catch security…

there's a lot of fear going around... the basics still apply and tightening overlooked parts of your attack surface so we built: 1. safe chain (open source package firewall) 2. aikido device…

🚨 Shai-Hulud is back. Compromising major packages like Alibaba's @antv suite, echarts-for-react, and timeago.js. Scrapes secrets from CI/CD runners, steals cloud and SSH credentials, plants…

Your npm install might already be compromised. Aikido Safe Chain intercepts npm, pip, yarn, pnpm, and uv -- scans packages against malware intel before they reach your machine. No API keys, no…

Update 5:05 PT: The attack has now expanded well beyond @TanStack and @Mistral. 373 malicious package-version entries across 169 npm package names, including @uipath, @squawk, @tallyui, @beproduct,…