SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM(aikido.dev)

317 points by birdculture 11 months ago | 98 comments

Aikido Security blog post reporting a second Shai Hulud npm supply-chain attack compromising packages from Zapier, ENS, AsyncAPI, PostHog, and Postman.

Telnyx package compromised on PyPI(aikido.dev)

70 points by overflowy 7 months ago | 25 comments

Glassworm is back: A new wave of invisible Unicode attacks hits repositories(aikido.dev)

283 points by robinhouston 7 months ago | 169 comments

The Claude Code Source Leak: fake tools, frustration regexes, undercover mode(alex000kim.com)

1310 points by alex000kim 6 months ago | 535 comments

Blog post analyzing Claude Code's source, exposed via a source map in Anthropic's npm package, covering anti-distillation fake tools, undercover mode, and frustration regexes.

Cloudflare/Security-Audit-Skill(github.com)

168 points by donk8r 1 month ago | 34 comments

Keyv and friends compromised in active Shai-Hulud supply chain attack(aikido.dev)

238 points by cimi_ 2 months ago | 126 comments