Company

Aikido

Application security company (Aikido Security) offering code and cloud scanning with AI code analysis; its researchers also report on package-registry malware.

Known aliases

aikido.dev
Aikido Security

Current stories

buildConfirmed4 publishers

In Tensorlake's npm SDK 0.5.144, a preinstall hook steals credentials before any sandbox runs

Tensorlake's npm SDK 0.5.144 runs a credential-stealing worm from a preinstall hook at install time, Socket reported. According to Socket's analysis, any secret reachable from a workstation or build runner that installed the release may be exposed.

Publishers:dev.to scworld.com socket.dev thehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 44%
Operator: Operator 50%
Investor: Investor 6%

Reality

Evidence74
Adoption25
Hype gap+10
Incentives35
Confidence72

securityConfirmed2 publishers

A pushed commit pulled MemTensor's npm and PyPI publish tokens out of its own release workflow

Three versions of MemTensor's MemOS Cloud plugin on npm and MemoryOS 2.0.34 on PyPI launch a Go stealer called sckit that reads the host environment and the user's prompt text, and the npm versions are still installable.

Publishers:scworld.com thehackernews.com

Reality

Evidence70
Adoption: Not scored
Hype gap+5
Incentives: Not scored
Confidence64

securityOne report1 publisher

A DPRK-linked package campaign has started publishing to HashiCorp's Terraform Registry

Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.

Publishers:thehackernews.com

Reality

Evidence66
Adoption21
Hype gap+14
Incentives72
Confidence58

buildOne report1 publisher

Pooling three passes turns DeepSeek Pro's 17 findings into 28 of 32

Aikido spent 11.7 billion tokens rediscovering 32 fresh CVEs with ten models, three attempts each. The number that should move a scanning budget is the marginal cost of the second and third pass.

Publishers:aikido.dev

Reality

Evidence44
Adoption18
Hype gap+32
Incentives76
Confidence52

investOne report1 publisher

Rust's arrayref hijack lasted 86 minutes, and Wiz ties it to North Korea

Compiling any project that resolved the poisoned crate on August 20 was enough to run a credential stealer. Wiz links the infrastructure to DPRK-attributed campaigns.

Publishers:cryptopolitan.com

Reality

Evidence48
Adoption61
Hype gap+17
Incentives63
Confidence52

buildOne report1 publisher

1,400 npm maintainer domains, 18 flags, and one word doing too much work

A dev.to post scanned the domains behind the top 5,000 npm packages and found 18 with registration or email-security anomalies. The aggregate numbers matter more than the 18, and the headline overstates both.

Publishers:dev.to

Reality

Evidence24
Adoption: Not scored
Hype gap+58
Incentives62
Confidence30