🧰 Aikido

The items that name it 23

• Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)
  advisory2026-10-23It is written here as Aikido: detects vulnerable Brotli and brotlicffi versions in repositories, container images and transitive dependencies, shows affected services, and checks the finding is gone after upgrade.
• Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
  advisory2026-10-22It is written here as Aikido: detects the vulnerability and shows which repositories and container images run a vulnerable Node.js version; a fresh check confirms the finding is gone after upgrade.
• Billy Lee (@billyozno) on X
  thread2026-10-21It is written here as Aikido: security firm that reported the Docker image litellm/litellm:1.107.0 was still live.
• LiteLLM compromised again: infostealer and RAT found in version 1.107.0
  writeup2026-10-21It is written here as Aikido (aikido.dev): publisher of the analysis.

  aikido.dev

• The OpenSourceMalware Show #24
  talk2026-10-09

  Named as an example scanner that, like others, misses multi-package combined-payload attacks with no malicious code in any single package.

• Tensorlake npm Package Compromised to Spread Shai-Hulud Worm
  article2026-10-08It is written here as Aikido: security firm whose technical report identified the malicious Tensorlake release and linked it to a new Shai-Hulud variant.
• tensorlake NPM package compromised with Shai Hulud worm
  writeup2026-10-08It is written here as Aikido (central feed / malware detection).

  Surfaces malware issues as a 100/100 critical issue for Aikido users monitoring repos; rescans nightly, manual rescan recommended.

• Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack
  writeup2026-08-20

  Security platform that detected the compromise; surfaces malware issues in central feed as 100/100 critical, rescans nightly, offers free-plan malware coverage

• Anthropic's Fever Dream: Claude's package that stole real keys
  writeup2026-07-31It is written here as Aikido (implied, as the publisher/vendor of the blog performing detection).

  The article's author's organization queried and flagged malicious PyPI packages since April, including anthropickit; also noted one of the 15 machines that ran the package was 'a security vendor's scanner doing what scanners do.'

• Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry
  writeup2026-07-09It is written here as Aikido (central feed / malware issue detection).

  Detects the malicious package as a 100/100 critical malware issue in a user's central feed; rescans nightly, with manual rescan recommended.

• XORCISM-AI/XORCISM
  repo2026-07-01

  Security scanning API import connector

• Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets
  writeup2026-06-24

  Security platform that detects the compromised action as a 100/100 critical malware issue in its central feed; rescans nightly, recommends manual rescan

• Over 140 popular Mastra npm Packages Hit by Supply Chain Attack
  writeup2026-06-17

  Security platform that detected the supply chain attack; malware issues surface as a 100/100 critical issue in the central feed; rescans nightly

• Multiple JetBrains IDE plugins caught stealing AI keys
  writeup2026-06-16

  Security platform that detected the campaign; central feed surfaces malware issues as a 100/100 critical issue; supports nightly and manual repo rescans.

• The Pros and Cons of NPM v12's Security Improvements
  article2026-06-10

  Commercial package firewall/supply-chain security product

• Compromised Rust crate onering performs code exfiltration
  writeup2026-06-10

  Security platform that detected the malicious onering release; surfaces malware issues as critical (100/100) in the central feed and performs nightly rescans

• What is AI SAST?
  article2026-06-06

  Security platform offering both AI-native SAST and AI-augmented (AI-assisted) SAST

• KeygraphHQ/shannon
  repo2026-05-23

  Tool referenced in Doyensec's comparison study against which Shannon's results on Photoview 2.4.0 were separately evaluated

• Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
  writeup2026-05-23

  Detects the malware issue (surfaces as 100/100 critical issue in central feed), rescans nightly, offers manual rescan; malware coverage included in free plan

• OWASP/DockSec
  repo2026-05-14

  Comparison point: commercial cloud platform offering AI remediation, sends data to its service (contrasted with DockSec's local/open-source design).

• Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack
  writeup2026-05-11

  Security platform that detects malware issues in dependencies via a central feed, surfaces this campaign as a 100/100 critical issue, and rescans nightly (manual rescan recommended); malware coverage included in free plan

• The complete GitHub Actions security checklist
  article2026-05-11

  Security platform/SAST scanner that detects insecure GitHub Actions workflows (unsafe pull_request_target, script injection, template/prompt injection in AI workflows, unpinned actions, overprivileged GITHUB_TOKEN, risky secret handling), flags workflow_run workflows missing event checks, automatica

• OWASP Free AppSec Tools
  article2026-05-06

  Combines SAST and Library Analysis (SCA) tools into a single dashboard; free for small teams and open-source projects