PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Safe Chain now enforces a minimum package age before install

aikido.dev | blog | #supply-chain | #devsecops | #malware | #npm | #aikido | #package-registry | #safe-chain
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Safe Chain holds npm versions published in the last 24 hours for analysis before install, falling back to older clean versions—closing the timing window attackers exploit in supply chain campaigns.
Published
Collected

Related coverage

blog · aikido.dev
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
# LiteLLM compromised again: infostealer and RAT found in version 1.107.0 Written by Ilyas Makari Published on: Oct 21, 2026 On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source...
blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
research · aikido.dev
Novel supplychain.local Go worm appears
On 23 September 2026, a threat actor published a novel supply chain worm to the following packages:
blog · aikido.dev
Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster
If you run PHP anywhere in your stack and did not upgrade, stop reading this and go upgrade to a patched version. More information on this is on our advisory blog, and check out php2shell.aikido.io to see if your service is potentially vulnerable.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
Back