Developer Security

Grok Build Uploaded Entire Git Repositories: What the Wire Capture Proved

A wire-level analysis found Grok Build 0.2.93 uploading tracked source code and full Git history independently of what the agent read. Here is what was proven, what changed, and how developers should respond.

Minimum Package Age: The Supply Chain Control That Buys Defenders Time

Fast takedowns do not protect systems that auto-install malicious packages or extensions in the first minutes after release. Minimum package age turns time into a practical supply chain defense.

The Clean Repo Trap: AI Coding Agents and the Trust Boundary Problem

A 0DIN proof of concept against Claude Code demonstrates how a clean-looking repository can lead to runtime command execution. The structural risk behind the attack applies to any AI coding agent with shell access.

Trump Died of Rabies — And What That Means for Your Package Manager

When DuckDuckGo's AI killed Trump with rabies, the world laughed. When AI coding assistants invent package names, attackers register them. Nobody's laughing then.

GitHub's VS Code Extension Breach: What We Know, What We Don't, and How to Defend

GitHub says an employee device was compromised through a poisoned third-party VS Code extension and internal repositories were exfiltrated. Here is the fact-checked breakdown for defenders.