Honored for protecting 2 billion requests per month. Because apparently, that’s plaque-worthy.

⚡️JUST DROPPED: The State of AI in Security & Development We asked 450 CISOs, AppSec engineers and developers across Europe and the US how AI is changing the way we build and secure software.

Breaking: Allseek and Haicker are joining Aikido Together we’re launching Aikido Attack, autonomous pentests that think like hackers and run in hours, not weeks. We’re entering a new chapter in pentesting and we’re excited to have the teams from Allseek and Haicker with us on this journey.

Did you catch the premiere? → aikido.dev/meetjarno

Here are a few places where Jarno does interviews, the rest are better left offline. But you can always meet him and ask -> aikido.dev/meetjarno

How did we scale from 30 to 140 team members in a year? Simple. Always be recruiting. Have you met Jarno? → aikido.dev/meetjarno

#1 Product of the Day, #3 Developer Tool of the Week. Crushed it.

🍿

Secure everything you build, host, and run. Aikido now launching at #1 on Product Hunt 🔥 Please upvote here → www.producthunt.com/products/aik...

tHe biGGesT sUpplY cHaiN atTAck iN hISTory!!!!!11 safe chain stars went brrr Free to use. Open source.

New, from me: At least 18 popular JavaScript code packages that are collectively downloaded more than two billion times each week were briefly compromised with malicious software today, after a developer involved in maintaining the projects was phished. The […] [Original post on infosec.exchange]

it appears the same attackers also compromised the JavaScript package duckdb (~350k downloads a week): https://www.aikido.dev/blog/duckdb-npm-packages-compromised

Le maintainer: “I’ve been pwned. Sorry everyone, very embarrassing.” Brian Krebs covered the npm supply chain compromise, featuring insights from our own @charlieeriksen.bsky.social, who broke the news. Full article → krebsonsecurity.com/2025/09/18-p...

MAINTAINER UPDATE: The maintainer of debug & chalk has taken down the packages and locked down his account; some packages remain affected. The phishing email used to target debug/chalk was 'support [at] npmjs [dot] help'

Update! The goal of the attacker is crypto.

🚨URGENT: A series of popular packages maintained by qix have just been compromised. Compromised packages include: • has-ansi - 12 million weekly downloads - V6.0.1 • supports-hyperlinks - 19m weekly downloads - v4.1.1 • chalk-template - 3.9m weekly downlaods - V1.1.1

In Khachatur’s words: “We didn’t make cars smaller so they could squeeze between trees, we built roads so we could drive them everywhere. AI code generation is the car. Together, we’re building the road.”

Happening this Thursday ❤️‍🔥 We’re back with the next edition of ~all vibes /no vulns. Hosted by our own Mackenzie Jackson, with special guests Igor A. (CISO @ Lovable) and Bil Harmer (CISO @ Supabase). Together we’ll build, hack, and secure an app in real time. Join us → luma.com/lovablexaiki...

The wait is over. Aikido Code Quality is live. Our favorite part? Roast mode. 🥵 Activate at your own risk → aikido.dev/quality

🚨 ALERT: The NPM package NX has been compromised (4.6m weekly downloads) - malicious versions (v20.9–20.12 & 21.5–21.8) were published on Aug 26 2025. The compromised packages have a postinstall script that scans for credentials and post them to the users GitHub account.

Happening TOMORROW. Willem Delbare (CEO & Co-founder, Aikido) and Khachatur V. (CEO & Co-founder, Trag) go live to talk about the future of code review. Quality code is secure code. Let’s talk about it → lu.ma/aikidoxtrag

We merged Trag into Aikido, to build the future of LLM-native code review together. Join Willem Delbare (Aikido) and Khachatur V. (Trag) for a live session on what this merger means, how AI code review is changing, and what’s next with our unified code + security product.

🔒 Security isn’t a checklist, it’s a mindset, built into every step of development. #Aikido helps developers grow by learning secure coding in context; each vulnerability they fix makes them better at preventing the next. 👇👇👇 www.aikido.dev/customer-sto...

Big news: Trag is now part of Aikido AI is writing more code than ever, and developers are stuck reviewing it with tools that were never built for this. Devs deserve better. That’s why we brought Trag into Aikido.

is somebody gonna match my freak

Look, a chart that goes up and to the right. Ground breaking.

Your AI code reviewer arrives 19 Aug 2025. Get early access: aikido.dev/quality

Rolled through Vegas. Until next time. 🧻🫡

Full room at DEF CON 🙌 Our very own Mackenzie took the AppSec Village stage for "AI vs. the APTs" and shared how AI is catching malware, hidden backdoors, and shadow-patched vulnerabilities before anyone else spots them. Appreciate everyone who came through.

And on the eighth day… we created the roll

Devs deserve better. Ship quality code faster with Aikido. Get early access → www.aikido.dev/quality

Cut the crap. New merch is here. 🧻 → theroll.dev

Introducing: The Roll. 🧻✨ We're serving "No Bullsh*t Security" on the Black Hat floor… literally. Get your limited-edition toilet paper roll at #BlackHat booth #6821 while supplies last. Or order yours online 👉 theroll.dev (Yes, we really did.)

AI code review that fixes real issues, not nitpicks. → aikido.dev/quality

Ship quality code, faster. Get early access → aikido.dev/quality

Introducing Aikido SafeChain 🔒⛓️ SafeChain wraps every npm, yarn, pnpm, and npx install. It blocks malware in real time, with zero changes to your workflow. Free. Open Source. Powered by Aikido Intel. Don’t trust your terminal. Defend it.

quality code is secure code

Introducing AutoFix for Containers with Hardened Images 💣 Upgrading base images is risky. Minor updates can break builds or cause bugs. Aikido’s AutoFix made fixes one click simple. Now, with Root, get hardened images patched automatically with no rebuilds.

Introducing Hardened Libraries. EOL dependencies force painful upgrades and rewrites just to stay secure. Aikido x TuxCare changes that. Fix vulnerabilities instantly with one-click AutoFix and drop-in hardened packages. Stay secure and keep building. ⚡

June highlights 🔥 We shipped: - Multi-cloud asset search (Azure too!) - Custom cloud alerts - Breaking change analysis - Inline PR comments for SCA - Free IDE plugins (Cursor, Windsurf, VSCode) - Container AutoFix (with Root) … and more! We ship every day. Check the changelog. Link in comments. 👇

51 new badges & all i got was this meme from marketing

⚡ We just made Aikido’s IDE extensions FREE. No credit card. No paywall. Just real-time security as you code (or generate). Free for: ✅JS, TS, & Python ✅ SAST + secret scanning + inline fixes ✅ For #VSCode, Cursor (@cursor.com.web.brid.gy) and windsurf (@windsurfai.bsky.social)

new #opengrep release 1.3.0 ft new features & bug fixes New features: ⭐ New --𝗳𝗼𝗿𝗰𝗲-𝗲𝘅𝗰𝗹𝘂𝗱𝗲 flag: apply --𝗲𝘅𝗰𝗹𝘂𝗱𝗲 on file targets ⭐New --𝗶𝗻𝗰𝗿𝗲𝗺𝗲𝗻𝘁𝗮𝗹-𝗼𝘂𝘁𝗽𝘂𝘁-𝗽𝗼𝘀𝘁𝗽𝗿𝗼𝗰𝗲𝘀𝘀 flag: enable post-processing (autofix, nosem) for incremental output (1/4)

Introducing Aikido AI Cloud Search 🌩️ ⚡ Go from question to insight, fast. Identify & correlate real risk in seconds, whether you want to identify exposed databases, overly permissive IAM roles... Just describe what you’re looking for: “Give me all VMs with CVE-2025-32433 that have port 22 open.”

🚨 New: Automatic Changelog Analysis for Open-Source Dependencies Before: ⏱️ waste 15 minutes scanning changelogs, comparing versions, assessing upgrade impact. Now: ⚡ 10 seconds with Aikido. • See breaking changes instantly • Upgrade versions in 1 click Don’t break your build—just ship.

hard launching Container AutoFix today 🔥 huge for devs wasting days on manual container upgrades fix vulnerable images automatically — with Aikido AI. break the fix>rebuild>break cycle in seconds - try it out 👀

icymi yesterday, we identified a major malware #supplychainattack in #XRP a backdoor was added to the official NPM package of XRP to steal private keys and send them to an attacker's C2 server 🗝️

🚨We have discovered a backdoor in the official #xrpl NPM package. This back door steals private keys and sends them to attackers. The affected versions 4.2.1 - 4.2.4, if you are using an earlier version, do not upgrade. #crypto #malware #npm

Mama, we made it 🥹 52 shiny new badges from G2’s Spring initiative (incl. Best Estd. ROI & Easiest to use). Check us out x

This week we launched Aikido Malware 👾 — a high-signal feed detecting malicious open-source packages on npm (and soon PyPI) • High-signal, fast threat data 🚨 • Open-source feed, AGPL-licensed 💸 • Built for devs & security teams, not just enterprises w/ 6-figure budgets 🫵