Learn about agentic coding security and Endor Labs

Malware in Open Source Ecosystems

New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages

Axios compromised: hijacked maintainer account pushes malicious npm versions

A Practitioner’s Guide to Responding to the TeamPCP Supply Chain Attacks

TeamPCP Strikes Again: Telnyx Compromised Three Days After LiteLLM

What We Can Learn About GitHub Actions Security from the Trivy Breach

SolarWinds took a nation-state. The next attack just needs an LLM and $5.

TeamPCP Isn't Done: Threat Actor Behind Trivy and KICS Compromises Now Hits LiteLLM's 95 Million Monthly Downloads on PyPI

CanisterWorm: Malicious npm Packages Deploy Self-Propagating Supply Chain Worm

AURI: Security Intelligence for Agentic Software Development

Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution

npm is serving malware to 134,000 developers, and the maintainer can’t stop it

Endor Labs + Zscaler: Zero Trust Application Security for the AI Era

How the EU Cyber Resilience Act (CRA) rewrites the rules of software liability

The Return of PhantomRaven: Detecting Three New Waves of npm Supply Chain Attacks

Intelligence and governance in the software supply chain with Endor Labs and Cloudsmith

Introducing AURI: Security Intelligence for AI Coding Agents and Developers

Remote Code Execution (RCE) in Ghost CMS (CVE-2026-29053): A Transitive Dependency Wreaks Havoc

EU Cyber Resilience Act

CVE-2026-27959: Userinfo Host Header Injection in Koa

Anthropic just validated that AppSec is the biggest opportunity in cybersecurity

SANDWORM_MODE: Dissecting a Multi-Stage npm Supply Chain Attack

CVE-2026-25896: Entity Encoding Bypass in fast-xml-parser

AI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass

Supply Chain Attack targeting Cline installs OpenClaw

How AI SAST Traced Data Flows to Uncover Six OpenClaw Vulnerabilities

The Missing Layer: Why Container OS Libraries Need Reachability Analysis

Introducing Full Stack Reachability: Container Scanning That Actually Reduces Noise

AI SAST in Action: Finding Real Vulnerabilities in OpenClaw

Context Engineering for Application Security

The Architectural Shift Behind the AI SDLC

Test-First Prompting: Using TDD for Secure AI-Generated Code

CVE-2026-25049 Expression Escape Vulnerability Leading to RCE in n8n

Static Analysis in the Age of AI, Part I: AI Coding Assistants

7 Snyk Alternatives for Engineering Teams in 2026

npm Account Takeovers are a Growing Malware Trend

CVE-2026-22709: Critical Sandbox Escape in vm2 Enables Arbitrary Code Execution

Classic Vulnerabilities Meet AI Infrastructure: Why MCP Needs AppSec

How Fake Font Packages Abused npm as a CDN

Your Next Breach Won’t Be a CVE: Connecting Real Incidents to AI-Aware Code Review

Astronomer Modernizes AppSec with Endor Labs

Eight for One: Multiple Vulnerabilities Fixed in the Node.js Runtime

n8mare on auth street: supply chain attack targets n8n ecosystem

CVE-2025-12543: Host Header Validation Bypass in Undertow

CVE-2025-68428: Critical Path Traversal in jsPDF

Bringing Malware Detection Into AI Coding Workflows with Cursor Hooks

When Regex Isn’t Enough: How We Discovered CVE-2025-13780 in pgAdmin

When a Broken Fix Leads to RCE: How We Found CVE-2025-66626 in Argo

From Vision to Reality: How Endor Labs Delivers Developer-First Security

Developer Experience: The Key to Successful Security

Critical Remote Code Execution (RCE) Vulnerabilities in React and Next.js

The New era of Code-to-Cloud Security

Rubrik Hits Aggressive SLAs via Endor Labs

Understanding NPM Worms and the Shai-Hulud Attack

Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime

The OWASP Top 10 Gets Modernized

How Endor Labs Is Supporting Bryce, a Next-Gen AppSec Builder

StackHawk + Endor Labs: Correlating SAST and DAST Alerts

AI SAST: Combining Agents, Program Analysis, and Rules for High-Confidence Code Security

Introducing AI SAST That Thinks Like a Security Engineer

Invisible Threats and the Blind Spots of Security 


Code-to-Cloud Application Risk Management with Upwind and Endor Labs

The Great Indonesian TEA Theft: Analyzing a NPM Spam Campaign

Happier DOMs: The perils of running untrusted JavaScript code outside of a web browser

Announcing Native Support for OWASP Secure Pipeline Verification Standard

OWASP Top 10 Adds A03:2025: Software Supply Chain Failures

Critical SQL Injection Vulnerability in Django (CVE-2025-64459)

False Negatives in SAST: Hidden Risks Behind the Noise

State of Dependency Management 2025

Why AI Code Gets Less Secure With Every Prompt

From Shift Left to Shift Down: Making SAST Work for Developers

Why SAST Failed (And What’s Next)

CVE-2025-53967 Remote Code Execution in Framelink Figma MCP Server

Rethinking the Interface: How Agentic UX is Shaping the Future of Endor Labs

Proactive Protection from Malware Attacks

Why Cooldown Windows Belong in Every npm Security Strategy

Zero Trust for Open Source: Why Enterprises Need a New AppSec Playbook

It’s Time to Take Malware Seriously (Attackers Do)

Fireside Chat: Building an AppSec Program for Cursor

A Practical Guide to AI and Application Security

How to Defend Against NPM Software Supply Chain Attacks

npm Malware Outbreak: Tinycolor and CrowdStrike Packages Compromised

Endor Labs Drives 225% Revenue Growth, Pioneers the Future of Secure SDLC

Major Supply Chain Attack Compromises Popular npm Packages Including chalk and debug

Nx build platform compromised by supply chain attack – How attackers collude with AI code assistants

How We Cracked SCA for C/C++ Codebases

Cursor Develops a Secure Product with Endor Labs

When CodeRabbit became PwnedRabbit: A cautionary tale for every GitHub App vendor (and their customers)

Shadow AI in Your Codebase: A Hidden Supply Chain Risk

Five9 Transforms Software Supply Chain Security with Endor Labs

Under the Hood: How I Vet Early-Stage Startups for Critical Security Programs

Detect End-of-Life (EOL) Software in Containers with Endor Labs

The Most Common Security Vulnerabilities in AI-Generated Code

The Last Mile of AI Productivity Is Code Review

Fireside Chat: CISOs on AI, Shift Left, and Building Trust at People.ai and AppLovin

Fireside Chat: Building a High-Trust Product Security Program at Zebra

How to Detect LLM Prompt Injection Risks

Why Your AI Code Assistant Might Be Shipping CVEs

Anti-Pattern Avoidance: A Simple Prompt Pattern for Safer AI-Generated Code