Learn about agentic coding security and Endor Labs

Trojanized ai-sdk-ollama Delivers Miasma, a Self-Replicating npm Worm via binding.gyp

Endor Labs Recognized in the Forrester Agentic Development Security Tools Landscape

Endor Labs + Cursor: Building the security foundation for agentic coding

Designing Reports for Three Different Workflows

Endor Labs Recognized by Gartner® in the 2026 Hype Cycle™ for Platform Engineering

Trojanized Microsoft SDK: durabletask 1.4.1 through 1.4.3 Deliver Credential-Stealing Malware

Endor Labs and Chainguard Partner to Deliver End-to-End Software Supply Chain Security

Mini Shai-Hulud Returns: 600+Malicious npm Packages Fake Sigstore Badges in AntV Ecosystem Attack

Designing AI Coding Agent Governance: A New Surface for AI Risk

When the Guardrails Slip: The Case for Hook-Based Governance Across Agent Platforms

From Code to Cloud: Endor Labs Joins the Wiz Integration Network

How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise

Introducing AI Coding Agent Governance: Using Hooks to Bring Visibility to the ADLC

Introducing Package Firewall

Malware Defense: A Multi-Agent Detection Engine and Package Firewall

Introducing Security for AI Coding Agents and Workstations

Shai-Hulud compromises the @tanstack ecosystem: 160+ packages compromised

Popular lightning PyPI Package Backdoored in Latest Shai-Hulud Wave

Beyond Mythos: A CISO's Guide to Building an Effective Software Security Program for the AI Era

Mini Shai-Hulud: npm Worm Hits SAP Developer Packages

GPT-5.5 Sets a New Code Security Record with Cursor, not Codex, in Agent Security League

Inside the Bitwarden Software Supply Chain Attack (Shai-Hulud)

The agent control plane needs a security layer

Organizational Behavior Predicts OSS Malware Program Success

Claude Opus 4.7 Sets New Records in the Endor Labs Agent Security League

Surge in submissions forces NIST to change how it handles CVEs. Here's what it means for vulnerability management.

The Dangers of Reusing Protobuf Definitions: Critical Code Execution in protobuf.js (GHSA-xq3m-2v4x-88gg)

It's About Thyme: How a Whitespace Character Broke Thymeleaf's Expression Sandbox (CVE-2026-40478)

Agent Security League: Evaluating the Security of AI-Coded Software

Is AI Coding Safe? Introducing the Agent Security League

The Unkillable C2: How Attackers Are Moving Command and Control to the Blockchain

Fable 5.1 takes the top spot — faster than Opus 5, cheaper, and cleaner

Root in One Request: Marimo's Critical Pre-Auth RCE (CVE-2026-39987)

What Security and Engineering Teams Fear Most About Malware

Malware in Open Source Ecosystems

New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages

Axios compromised: hijacked maintainer account pushes malicious npm versions

A Practitioner’s Guide to Responding to the TeamPCP Supply Chain Attacks

TeamPCP Strikes Again: Telnyx Compromised Three Days After LiteLLM

What We Can Learn About GitHub Actions Security from the Trivy Breach

SolarWinds took a nation-state. The next attack just needs an LLM and $5.

TeamPCP Isn't Done: Threat Actor Behind Trivy and KICS Compromises Now Hits LiteLLM's 95 Million Monthly Downloads on PyPI

CanisterWorm: Malicious npm Packages Deploy Self-Propagating Supply Chain Worm

AURI: Security Intelligence for Agentic Software Development

Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution

npm is serving malware to 134,000 developers, and the maintainer can’t stop it

Endor Labs + Zscaler: Zero Trust Application Security for the AI Era

How the EU Cyber Resilience Act (CRA) rewrites the rules of software liability

The Return of PhantomRaven: Detecting Three New Waves of npm Supply Chain Attacks

Intelligence and governance in the software supply chain with Endor Labs and Cloudsmith

Introducing AURI: Security Intelligence for AI Coding Agents and Developers

Remote Code Execution (RCE) in Ghost CMS (CVE-2026-29053): A Transitive Dependency Wreaks Havoc

EU Cyber Resilience Act

CVE-2026-27959: Userinfo Host Header Injection in Koa

Anthropic just validated that AppSec is the biggest opportunity in cybersecurity

SANDWORM_MODE: Dissecting a Multi-Stage npm Supply Chain Attack

CVE-2026-25896: Entity Encoding Bypass in fast-xml-parser

AI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass

Supply Chain Attack targeting Cline installs OpenClaw

How AI SAST Traced Data Flows to Uncover Six OpenClaw Vulnerabilities

The Missing Layer: Why Container OS Libraries Need Reachability Analysis

Introducing Full Stack Reachability: Container Scanning That Actually Reduces Noise

AI SAST in Action: Finding Real Vulnerabilities in OpenClaw

Context Engineering for Application Security

The Architectural Shift Behind the AI SDLC

Test-First Prompting: Using TDD for Secure AI-Generated Code

CVE-2026-25049 Expression Escape Vulnerability Leading to RCE in n8n

Static Analysis in the Age of AI, Part I: AI Coding Assistants

7 Snyk Alternatives for Engineering Teams in 2026

npm Account Takeovers are a Growing Malware Trend

CVE-2026-22709: Critical Sandbox Escape in vm2 Enables Arbitrary Code Execution

Classic Vulnerabilities Meet AI Infrastructure: Why MCP Needs AppSec

How Fake Font Packages Abused npm as a CDN

Your Next Breach Won’t Be a CVE: Connecting Real Incidents to AI-Aware Code Review

Astronomer Modernizes AppSec with Endor Labs

Eight for One: Multiple Vulnerabilities Fixed in the Node.js Runtime

n8mare on auth street: supply chain attack targets n8n ecosystem

CVE-2025-12543: Host Header Validation Bypass in Undertow

CVE-2025-68428: Critical Path Traversal in jsPDF

Bringing Malware Detection Into AI Coding Workflows with Cursor Hooks

When Regex Isn’t Enough: How We Discovered CVE-2025-13780 in pgAdmin

When a Broken Fix Leads to RCE: How We Found CVE-2025-66626 in Argo

From Vision to Reality: How Endor Labs Delivers Developer-First Security

Developer Experience: The Key to Successful Security

Critical Remote Code Execution (RCE) Vulnerabilities in React and Next.js

The New era of Code-to-Cloud Security

Rubrik Hits Aggressive SLAs via Endor Labs

Understanding NPM Worms and the Shai-Hulud Attack

Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime

The OWASP Top 10 Gets Modernized

How Endor Labs Is Supporting Bryce, a Next-Gen AppSec Builder

StackHawk + Endor Labs: Correlating SAST and DAST Alerts

AI SAST: Combining Agents, Program Analysis, and Rules for High-Confidence Code Security

Introducing AI SAST That Thinks Like a Security Engineer

Invisible Threats and the Blind Spots of Security 


Code-to-Cloud Application Risk Management with Upwind and Endor Labs

The Great Indonesian TEA Theft: Analyzing a NPM Spam Campaign

Happier DOMs: The perils of running untrusted JavaScript code outside of a web browser

Announcing Native Support for OWASP Secure Pipeline Verification Standard