AURI by Endor Labs is built for the AI-SDLC where agents write, review, and ship code.
Learn more:
www.endorlabs.com/learn/introducing-auri-security-intelligence-for-ai-coding-agents-and-developers
A critical entity encoding bypass affects fast-xml-parser (40M+ weekly npm downloads).
www.endorlabs.com/learn/cve-20...
Today we're announcing Container Reachability, delivering full-stack reachability across application and base layers.
www.endorlabs.com/learn/introducing-full-stack-reachability-container-scanning-that-actually-reduces-noise
#ContainerSecurity #DevSecOps #FedRAMP
AI is great at copying homework, including the mistakes.
A 2025 study found:
❌ 15/20 AI snippets had design flaws
❌ 6/20 were invisible to security tools
AI follows patterns, not logic, effectively amplifying your code's existing flaws.
Read the full research:
www.endorlabs.com/learn/design...
Rubrik used Endor Labs to confirm they weren’t affected by a major npm attack in ~30 minutes.
101 fake font packages.
4.3 petabytes transferred.
Zero malware.
This wasn’t a supply-chain attack. npm was quietly used as a CDN at massive scale.
Henrik Plate explains how it happened and why abuse, not just malware, is becoming a serious OSS sustainability risk.
endorlabs.com/learn/how-fa...
Gemini CLI @endorlabs.bsky.social Extension
github.com/endorlabs/ge...
We discovered a critical pgAdmin vulnerability (CVE-2025-13780): whitespace bypassed a regex meant to block dangerous psql meta-commands.
A great example of why regex is fragile for input validation.
Deep dive:
www.endorlabs.com/learn/when-r...
A patch in Argo Workflows was supposed to fix a ZipSlip issue… but it didn’t.
Our research uncovered CVE-2025-66626 — a validation bug that let malicious tarballs escape the working directory and reach RCE.
Full write-up:
www.endorlabs.com/learn/when-a...
Shai Hulud’s latest wave shows cross-ecosystem spread: an infected posthog-node package was rebundled as a Java archive and pushed to Maven Central via mvnpm.
Version 4.18.1 is removed, and other rebundles appear clean.
Key point: malware is now moving between ecosystems automatically.
Shai-Hulud shows how fast npm worms can move through packages, CI workflows, and maintainer accounts. Shared code speeds development, and expands the impact of compromised creds.
Full breakdown from Robert Haynes:
www.endorlabs.com/learn/unders...
#ShaiHulud #Malware
A new Shai-Hulud variant just escalated from stealing credentials to attempting to wipe the entire home directory when exfiltration fails.
If you use npm: audit your packages, remove bad versions, rotate tokens, and inspect every workflow.
www.endorlabs.com/learn/shai-h...
#ShaiHulud #malware
Wednesday was a double dose of baseball! ⚾
From Braves vs. White Sox in Atlanta to Cubs vs. Brewers in Chicago, we had a great time enjoying the games with our partners at @endorlabs.bsky.social
A big thank you to everyone who joined us!
#AppSec #DevOps
The @endorlabs.bsky.social + @stackhawk.bsky.social
integration connects SAST + DAST for one correlated finding.
Less noise. Real context. Faster fixes.
🔗 www.stackhawk.com/blog/endor-l...
Endor Labs’ 2025 State of Dependency Management report is live!
-49% of dependencies imported by AI agents had known vulns.
-34% didn’t exist at all.
-Only 1 in 5 was safe.
www.endorlabs.com/lp/state-of-...
#MCP #AIAgents #DMR2025
🔔 Update on the ongoing "Shai-Hulud" malware campaign
The Endor Labs security research team has identified more than 550+ packages and versions affected by the ongoing "Shai-Hulud" software supply chain attack targeting the npm registry.
www.endorlabs.com/learn/npm-ma...
AI is changing how software gets built. Today, we’re changing how it gets secured with the expansion of our application security platform and a $93M Series B to accelerate what we’re building.
More here: bit.ly/42DqUmB
#AppSec #SeriesB #EndorLabs #DevSecOps #Cybersecurity
Developers are moving faster than ever with tools like GitHub Copilot.
The result?
62% of AI-generated code has flaws
Nearly 30% contains known security weaknesses
Next week, we’re announcing a new way for AppSec teams to understand what’s changing and why it matters.
#AppSec #AI #LLM #DevSecOps
OWASP OSS Risk 2: Explore the compromise of legitimate open-source packages, with an in-depth case study of the tj-actions/changed-files GitHub Action supply chain attack.
www.endorlabs.com/learn/owasp-...
#OSSRisk #OWASPOSSRisk #tjactions
Attackers compromised tj-actions/changed-files, used by 23,000+ repos, injecting malicious code to steal CI/CD secrets.
What you need to know and how to mitigate:
www.endorlabs.com/learn/github...
Less than 9.5% of vulnerabilities are actually exploitable, but FedRAMP ConMon requires fixing everything.
With Endor Labs, you can:
- Prove false positives to your 3PAO
- Correlate SCA & container scans
- Patch vulnerabilities 6.2x faster with Endor Patches
www.endorlabs.com/landing-page...
The latest CISO guide from The Hacker News makes it clear - EU AI Act, ISO 42001, and NIST AI RMF all require it.
But inventory is just the start. You also need to enforce AI policies. Endor Labs can help you there.
About CLEAR framework:
thehackernews.com/2025/02/how-...
#AI #AppSec #DevSecOps
Endor Labs ❤️ GitHub
Context switching is a productivity killer. Developers live on GitHub, so #AppSec should too.
With Endor Labs Reachability-based SCA now integrated into GHAS, teams can get best-in-class application security, all in one place.
github.blog/security/fro...
DeepSeek R1 is the latest open source AI model to generate a lot of buzz. Developers are trying it out, and AppSec teams may be wondering about risks.
Endor Labs can give AppSec teams data and tools to make and enforce decisions about acceptable AI risk from DeepSeek R1.
#DeepSeek #AIModels #SCA
On Dec 13, Semgrep's license changes limited access to key security tools and community rules. Enter Opengrep: a fully open source, drop-in replacement backed by 10+ security companies.
Key benefits: no paywalls, community rules accessible, foundation governance, and easy migration!
Curious to know—how often do AppSec and CloudSec work together? Share your thoughts in the comments!
a) Often, we're the same team!
b) Sometimes, depending on work
c) Lol, who?
Big news! 🎉 Microsoft has natively integrated our advanced SCA within Defender for Cloud. Our integration is in Public Preview and available to try now!
www.endorlabs.com/learn/micros...
