The @bitwarden/cli npm package v2026.4.0 was compromised on April 22, 2026, with a loader fetching Bun to run obfuscated code that stole npm tokens, GitHub keys, SSH keys, and cloud credentials. #DevSecurity #NpmBreach #USA
002149
Posts with #DevSecurity
#DevSecurity
Public posts on X that use #DevSecurity.
Related hashtags
Dhruv Garg@dhruv_garg9Stop leaking API keys in git commits. pipx install open-source-secret-watcher →secretwatch guard install One command per repo. Blocks Stripe, AWS, GitHub tokens and more before they ever hit your history. Any language, any repo. #DevSecurity #OpenSource #Python #GitHooks00277
DeepRead@DeepReadTechBackdoors in official Claude Code extensions send one team into a panic audit of every extension they installed, and it ends somewhere they didn't expect. What's installed that you never read? #ClaudeCode #DevSecurity0004
🔐 MCP server vulnerability alert: 200k servers at risk. Go serverless for safer deployment! #DevSecurity015311
TryWaitEarn@TryWaitEarnChina just flagged Claude Code as a backdoor risk. Alibaba banned it internally. Every MCP server you wire into your agent is a new attack surface. Do you actually audit yours, or just trust the marketplace listing? #AIagents #MCP #DevSecurity #Claude209142
Koussai · Full-Stack & AI News@koussaidevA fake Claude Code extension sat in Cursor's marketplace on 29 Oct and tried to plant an SSH backdoor on up to 5,000 machines. If you installed v2.1.312 or 2.1.313, update to 2.1.314 and follow Cursor's clean-up steps. Check your extensions, folks. #DevSecurity101105
Google's coding agent now warns you about itself. @testingcatalog spotted a new Antigravity notice citing "data exfiltration and possible code execution" risks. My take: honest warnings beat surprises. Agents on your real repo: yes, or sandbox only? #AI #CyberSecurity20143
@OmidMasoom@OmidMasoom @testingcatalog An agent shipping with a warning label about itself is refreshingly honest, like a puppy wearing a 'chews cables' tag. Our vote: sandbox first, real repo once it has earned the keys, and never the folder where your .env lives. #DevSecurity00011
Use Claude Code inside Cursor? Take 30 seconds and check this one 🔐🧑💻 @cursor_ai found a fake Claude Code extension (v2.1.313) in its extension marketplace. It was not built by @AnthropicAI. At most 5,000 users got it.Cursor @cursor_aiWe identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the Grok Bot, Grok or our other SpaceXSI products. In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk. If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314:10031
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the Grok Bot, Grok or our other SpaceXSI products. In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk. If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314:5551.1K7K1.3M- @fablesdev@cursor_ai @AnthropicAI 🛠️ Check on macOS: grep -s svc-telemetry ~/.ssh/authorized_keys Nothing printed? You're fine. Got a match? Uninstalling may not be enough. Run Cursor's cleanup script, rotate creds from a clean machine, update to 2.1.314. Windows steps here 👇10025
- @fablesdev@cursor_ai @AnthropicAI My 2 cents: an extension runs with your full user rights. Your agent setup is only as safe as the weakest plugin in it 🧩 Pin versions, read update notes, check the publisher before you hit install. #DevSecurity #ClaudeCode Follow along. Our app is coming soon 🚀00213
🚨 Filtrar una API key puede costarte dinero real: gastos en cloud disparados, transacciones fraudulentas y cuentas comprometidas. No cometas este error. Aquí te explico por qué 🔐 #Ciberseguridad #APIKeys #DevSecurity1115652
A tampered Claude Code extension sat in Cursor's marketplace for about 11 hours, planting an SSH backdoor on up to 5,000 machines. It shipped under Anthropic's real extension ID. Your coding agent is part of your supply chain. #ClaudeCode #Cursor #DevSecurity001354
Scriptonia@Scriptonia_xyzThe app worked. The design was clean. But every unpatched endpoint… Every missing MFA step… Felt like an open invitation. You stopped shipping features. And started building defenses. #CyberSecureDev #BuildToProtect #DevSecurity #100DaysOfPrompting
01351
Vikas Kumar@DevCodeHub99🚨 axios@1.14.1 and axios@0.30.4 are malicious. They install a RAT on your machine. Dropper self-destructs. npm audit shows nothing. Check now: ls node_modules/plain-crypto-js If it exists — you're compromised. #DevSecurity #npm102543
Duclair Fopa ♈@BlockchainMonk_⚠️ Are you running untrusted code directly on your machine? STOP NOW! Just read @mattaereal's eye-opening article on devcontainers—the sandbox solution every developer needs. Don't be the next security horror story 👇 #DevSecurity #Containers
006103
Mojo's Everything@MojoEverythingDevs, imagine dApps unhackable from deploy. @Abatis_ABTU's immutable agents enforce that via $ABTU. Redeem for endpoint lockdowns, integrate kernel-level defense. No more post-breach forensics—prevention is the protocol. Code fearless! #DevSecurity @Abatis_ABTU00110- Mojo's Everything@MojoEverythingDevs, imagine dApps unhackable from deploy. @Abatis_ABTU's immutable agents enforce that via $ABTU. Redeem for endpoint lockdowns, integrate kernel-level defense. No more post-breach forensics—prevention is the protocol. Code fearless! #DevSecurity @Abatis_ABTU0024
burso@BursaMatusA trojanized Claude Code extension (2.1.312/2.1.313), not built by Anthropic, sat in Cursor's marketplace for ~11h on Oct 29. It planted an "svc-telemetry" SSH key, persistence and a reverse tunnel. Installed it? Clean up and rotate creds. #SupplyChain #DevSecurity #Malware #AI
00030
Lakhdar Med 💻@Lakmed11Have you ever faced a security issues in a project? How did you fix them?160143K
Techlusion@Techlusion_it@Lakmed11@Lakmed11 Yes, faced security issues like SQL injection and data leaks. Fixed by using parameterized queries, adding MFA, and encrypting data. Stay updated and vigilant. #DevSecurity #Techlusion00223- Fake VS Code alerts with bogus CVE IDs are spreading malware via GitHub Discussions by impersonating maintainers and tagging users. Malware payloads are delivered after profiling victims through JavaScript scripts. #DevSecurity #GitHubAttacks #USA001145
How do you store secrets in apps you ship? • .env files • secret managers • something else Share a quick reason and one real world example. #DevSecurity414130
Tweet 1/6 🚨 Vibe-coding is exploding: describe your app in plain English, let AI spit out working code in seconds! 🔥 Super fast for prototypes & ideas. But skipping deep reviews? That's a recipe for disaster. Time to talk safeguards! 🛡️ #VibeCoding #AICoding #DevSecurity20074- Show more posts
