.avif)
Welcome to our blog.
Introducing Safe-Chain: Stopping Malicious npm Packages Before They Wreck Your Project
Safe-Chain by Aikido is a powerful tool to prevent installing any malicious package version by verifying each package with the Aikido Intel database and blocking any packages with known malware.
Customer Stories
See how teams like yours are using Aikido to simplify security and ship with confidence.
Compliance
Stay ahead of audits with clear, dev-friendly guidance on SOC 2, ISO standards, GDPR, NIS, and more.
Guides & Best Practices
Actionable tips, security workflows, and how-to guides to help you ship safer code faster.
DevSec Tools & Comparisons
Deep dives and side-by-sides of the top tools in the AppSec and DevSecOps landscape.
Hide and Fail: Obfuscated Malware, Empty Payloads, and npm Shenanigans
Investigating a failed npm malware campaign using time-delayed payloads, obfuscation tricks, and reused dependencies.
Why Lockfiles Matter for Supply Chain Security
Lockfiles secure your software supply chain by ensuring consistent, tamper-proof dependencies.
Launching Aikido Malware – Open Source Threat Feed
launching Aikido Malware — our proprietary malware feed built to detect and track malicious packages in open-source ecosystems like npm and soon, PyPI.
Get the TL;DR: tj-actions/changed-files Supply Chain Attack
Let’s get into the tj-actions/changed-files supply chain attack, what you should do, what happened, and more information.
Sensing and blocking JavaScript SQL injection attacks
Safeguard your apps from JavaScript SQL injection attacks by understanding common vulnerabilities and deploying embedded AppSec solutions like Firewall.
Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained
Discover how Prisma ORM and PostgreSQL can be vulnerable to operator injection, a form of NoSQL injection. Learn how attackers exploit this risk and get practical tips to secure your JavaScript applications with input validation and safe query practices.
Launching Opengrep | Why we forked Semgrep
Meet Opengrep, the open source SAST engine – a fork of Semgrep. We initiated Opengrep to advance and commoditize SAST across the appsec industry.
Your Client Requires NIS2 Vulnerability Patching. Now What?
Discover vulnerability requirements for NIS2 vulnerability patching compliance. Learn about critical timelines, proper documentation, and strategies to streamline your processes. Ensure your business meets EU cybersecurity standards efficiently.
The Startup's Open-Source Guide to Application Security
This comprehensive guide explores the some of the best open-source tools to build a security program for start-ups.
Reducing Cybersecurity Debt with AI Autotriage
We dive into how AI can assist us in a meaningful way to triage vulnerabilities and get rid of our security debt.
XRP supply chain attack: Official NPM package infected with crypto stealing backdoor
The official XPRL (Ripple) NPM package was compromised by sophisticated attackers who put in a backdoor to steal cryptocurrency private keys and gain access to cryptocurrency wallets.
Top Container Scanning Tools in 2025
Discover the best Container Scanning tools in 2025. Compare features, pros, cons, and integrations to choose the right solution for your DevSecOps pipeline.
SAST vs DAST: What you need to know.
Get an overview of SAST vs DAST, what they are, how to use them together, and why they matter for your application security.
Get secure for free
Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.
.avif)
