PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SCA Everywhere: Scan and Fix Open-Source Dependencies in Your IDE

aikido.dev | blog | #supply-chain | #devsecops | #aikido | #sca | #dependencies | #ide | #autofix
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Aikido's IDE extension now runs the full SCA workflow: scan manifests and lockfiles for CVEs with safe upgrade ranges, fix via AutoFix, and auto-refresh as lockfiles change.
Published
Collected

Related coverage

blog · aikido.dev
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
# LiteLLM compromised again: infostealer and RAT found in version 1.107.0 Written by Ilyas Makari Published on: Oct 21, 2026 On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source...
blog · aikido.dev
Supply Chain Security: The Ultimate Guide to Software Composition Analysis (SCA) Tools
Guide to Software Composition Analysis: with 70–90% of app code from open source, SCA scans direct and transitive dependencies against CVE databases to prioritize real risks over noisy alerts.
blog · aikido.dev
Why Securing Bazel Builds is So Hard (And How to Make It Easier)
Bazel lacks standard lockfiles and manifests, making security scanning painful; Aikido now scans Bazel projects automatically and flags risky dependencies, replacing custom scripts and CI hacks.
blog · bugbunny.ai
Open Source Vulnerability Management: Fixing Dependency Risk Without Alert Fatigue
Open-source vulnerability management without alert fatigue: build a dependency inventory from manifests, lockfiles and images, then prioritize by reachability and exposure instead of chasing every CVE.
blog · bugbunny.ai
Software Composition Analysis: Beyond Dependency CVE Lists
Software composition analysis beyond CVE lists: build an accurate SBOM, tie dependencies to services and owners, prioritize by reachability, and watch build-time tools and package scripts too.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
Back