Back in February and the early OpenClaw days.. If you've installed a skill form ClawHub, there was a 13% chance it contains a critical security flaw and a non-zero chance it's actively exfiltrating your credentials right now

go read :) agent skills and agentic supply chain security is a real thing. we ran a research at Snyk back in February and the study is published if you enjoy reading those technical papers (toxicskills)

are you this old??

I know this is 5 years late but thank you joker, appreciate the Express middleware enhancement 🚀

what a time to be alive!!! (just so you know *I* wrote those tests like 8 years ago or something 😆)

aaaaaaa 😍 you know where to find my new publications

New security control from GitHub / npm - the new staged publishing on npm (following all the Shai Hulud supply chain incidents) protects from what..? seems like this prevents OIDC token doing the auto-publish for a version but not from maintainer account compromise (ATO)

New security control from GitHub / npm - the new staged publishing on npm (following all the Shai Hulud supply chain incidents) protects from what..? seems like this prevents OIDC token doing the auto-publish for a version but not from maintainer account compromise (ATO)

ahh yes of course you can circumvent around auto-mode Claude Code 😅

interesting to see Rapid7 at a market cap that's half of their ARR what do you make of this?

you can't fix your GitHub Actions workflow soon enough go review before it's too late and you horde a supply chain attack

agentify all the things h/t peter steinberger

what if your agent blindly installs npm packages or run npx commands? my Cursor install has Snyk so the hooks, MCP server and skills add guardrails so that agentic development doesn't introduce malware or other security issues

what if your agent blindly installs npm packages or run npx commands? my Cursor install has Snyk so the hooks, MCP server and skills add guardrails so that agentic development doesn't introduce malware or other security issues

have you ever seen with 20 years of open source contribution graphs look like? here's daloRADIUS a project I started in 2007 still kicking in 2026 and helping businesses

if this is the first time you see this GitHub graphic it means you don't actualy do code reviews

interesting on Cursor that even though I have a specific model chosen (gpt-5.5) it will explicitly use faster and homebrew models of its own like composer 2.5

im tried boss

damn, we're very very cooked

your new morning routine

what if you find out you've been infected with the Shai Hulud worm? watch here: www.youtube.com/watch?v=YrwM... Brian Clark goes through the TanStack supply chain attack, details, recap, and follow through for secure development

I provided 2 real examples in this write-up (to the blog writer agent) to show why you need relevant technical experience from a dev perspective to really wield agentic success lirantal.com/blog/coding-...

oh no.... /goal is now manifested in Cursor when using the gpt-5.5 high reasoning? not sure I like it for example, it misses out a few task list items I explicitly asked it to account for ugh

should I raise this RFC rename to npm?

how fast should I run?

prediction: malware is going to bring back IIFE back to be mainstream in JavaScript ;-)

Many new Snyk Learn lessons that each you AI skills + security on agentic coding 🤖 BOOKMARK Then go learn: learn.snyk.io

bye bye IC, hello HI-C ? nice framing from Lenny's newsletter

in a project contribution guidelines what's your take? especially given that coding agents have found their way into open source contribution being a big thing over the last year

hmmm how big is that qwen 1.5b parameters? this might not be a bad idea to mitigate prompt injection (on the cost of latency of course)

everyone's sleepin on B2A or what

I'll not be surprised if the following packages will be the target for the next supply chain attack: @parcel/*, core-js, esbuild, protobufjs, vue-demi, spawn-sync, @swc/* unrs-resolver, typescript, shap, exif-reader

I'll not be surprised if the following packages will be the target for the next supply chain attack: @parcel/*, core-js, esbuild, protobufjs, vue-demi, spawn-sync, @swc/* unrs-resolver, typescript, shap, exif-reader

is your website agent ready? my personal blog is at lirantal.com

murphy law isn't a real thing right? right??

I just love this guy

so this is the new normal right?

Precision (60%): "4 out of 10 comments are just noise" Recall (52%): "We are only catching half of the total bugs" would you use this code review agent?

coderabbit is probably one of the most popular code review agents, right? from this benchmark: - almost 50% are false positives - almost 50% of real issues are missed do you internalize? and that's if you even actually read and attend to the issues reported

gonna print and frame it in the living room

Claude Code 🤝 Snyk The security skill you were missing all along 💜

Cursor team how did you not think to namespace plans to specific projects/workspaces?? 😭

you got that right, plan plan plan

if you're building benchmarking based on agent harnesses like Claude Code like I've been up to then you might not know that SDKResultMessage gives you complete token usage with $ cost super handy!

npm fear/vibe index

I can just CSS away the fixes via natural language, so yeah I'm here for all the language models and coding agents you want to throw at me, I'll take them!

living la vida loca

"View as Tree" should be the default, don't make me change this every time I work on a new project ooofff

we were robbed of Star Wars mix with DeLorean