Cloudflare imagine the DX for wrangler CLI if you can help alleviate env vars resolution in smarter ways

another very nice catch by Qodo AI code review bot that prevented potential insecure guidance to a npm security best practices repository the details matter!

why in the frigging hell this repository list is not ordered properly? github do you really think I want to select a repository from 2014 to give an app access to? please fix

dependency cooldown across package managers (npm, bun, pnpm): github.com/lirantal/npm... These configurations prevent package managers from installing any package version that was published less than the specified time period ago btw Snyk automatically includes a built-in cooldown period for de

avoid the next malicious package disaster with pnpm security hardening: github.com/lirantal/npm... Security Best Practice: Set trustPolicy: no-downgrade so that pnpm refuses to install any package version whose trust evidence is weaker than a previously published version of that package

avoid the next malicious package disaster with pnpm security hardening: github.com/lirantal/npm... Security Best Practice: Set trustPolicy: no-downgrade so that pnpm refuses to install any package version whose trust evidence is weaker than a previously published version of that package

prevent the next npm supply chain security incident with pnpm security hardening:

your daily reminder for npm security best practices

not gonna lie, I feel like I'm back at uni again

tokenu - give your agents a CLI to count tokens size of files and directories: github.com/lirantal/tok...

I put together a new PyPI Security Best Practices for Python package managers (uv and pip) github.com/lirantal/pyp... Appreciate review and assistance keeping this one up to date ✨

nock is a popular and well-known HTTP mocking library for JavaScript but version 15 had a provenance regression how do I know? $ npq nock also works with $ npq install nock which pass-through to your package manager of choice to actually install after supply chain checks

what if you used npq to assess bad package health signals and vulnerabilities before you installed malware from npm...? $ npq <package> also works with $ npq install <package> which pass-through to your package manager of choice to actually install after supply chain checks

did we talk about Claude Code source code having the axios dependency in it or did it fly through everything else... just wondering if someone took a look at the actual versions in-use

is this a known coding pattern with composer-2 ?

is this a known coding pattern with composer-2 ?

it is so easily telling that this code is LLM generated what other tells you noticed?

I know developers only pay attention to security when incidents happen but here's your chance to take some agency and proactively learn, tighten and adopt tools and techniques to avoid becoming the next victim of supply chain trauma

oh look, axios is trending on GitHub, must be a great library. brb, going to install latest version.

insane and maybe you don't really get how complicated and involved the process is if you didn't to exploit development before but this is incredibly effective and only going to accelerate if you're not highly alert and wholeheartedly concerned yet... well, the blow is going to hurt

software to a container ai agent to a sandbox i do not make the rules 🙅‍♂️

software belongs in a sandbox

I'm reading a research paper that compares various models. it was published less than 12 months ago, yet I am pretty sure the average developer has no recall of any of these model names, am I right? that's how fast we have accelerated

nothing yet picked up in 2026 :( send help

what are some good benchmarking write-ups you've read? in the form of a blog post and web content, not an academic technical paper think along the lines of LLM model comparisons etc

hah, it's a funny fix you know why right

hah, it's a funny fix you know why right

had some questions on the internal Snyk slack that prompted me to shared an old write-up from 2019 about lockfiles so here's a read for ya: snyk.io/blog/what-is...

zero day clock is at 1.1 TTE (time to exploit) on average, and 61 weaponized payloads hell of a time for cybersecurity

check out AI Sec News for a curated newsletter on AI Security Engineering:

When there's a SKILL, there's a way

Ship or die

while we're on the topic of axios malware and supply chain security... I have friends who do blind upgrades in CI and other places. please don't be them. never blindly install software. npm install == sh -c. not worth it.

what's your /context usage looks like on average?

can you imagine if attackers had waited with their c2 malware just 24 hours we could have had axios going to the moon remember we were robbed from js in space :(

Aaron really cooked with this one 🔥 SoloTerm looks hot: soloterm.com

flowcharts from 12 years ago, before we had AI auto write mermaid diagrams for us ;-)

FYI on April 24th GitHub will begin training on your code for GitHub Copilot so unless you want this forced default opt-in, go to settings and disable 👇

FYI on April 24th GitHub will begin training on your code for GitHub Copilot so unless you want this forced default opt-in, go to settings and disable 👇

a contributor add one of their projects called pompelmi that scans files for Node.js apps with Express, Fastify, etc it made me nostalgic about a similar project I undertook back in 2016 for one of my teams :-)

so between all those biome and oxlint, what are y'all gravitating towards? considering a lighter setup than eslint and its related ecosystem which is quite a bit of dependency version sprawl to keep up with

if you find yourself creating skills a lot, you might want to check out my skills-creator-extra on the @Tessl registry

beautiful math meets beautiful art

claude'ing away a coding agent security benchmark what would you like to know?

💡 The security failures that lead to the LiteLLM compromise and malware propagation weren't new... In fact, Snyk already in 2024 warned of GitHub Actions failures and provided tools to pin down dependencies and lock down your CI workflows:

the gh cli has no way of copying directories/files from a given repo to disk and you have to use a community gh-cp extension for it?? 🤦‍♂️ oh lord

supposedly this article about "MCP is a Fad" is suggesting to use "just" as a wrapper for commands to avoid bash tool use. genius or epic fail? if you think that's a security mitigation then you haven't seen how creative LLMs can be

🚨 If anyone here uses, depends or builds with LiteLLM, FYI that there's been a compromise for new versions a few hours ago and there's already a supply chain security fallout for other projects. More details here:

More than anything else, Cursor Glass is likely a core objective to move out of the VS Code fork and into their own closed source, lightweight and thinner and stable version of an agentic development platform

got hit by GitHub today ugggghh