.avif)
Welcome to our blog.
.png)
npm debug and chalk packages compromised
The popular packages debug and chalk on npm have been compromised with malicious code
Without a Dependency Graph Across Code, Containers, and Cloud, You’re Blind to Real Vulnerabilities
Stop drowning in CVEs. Without a dependency graph across code, containers, and cloud, you’ll miss real vulnerabilities and chase false positives
.png)
WTF is Vibe Coding Security? Risks, Examples, and How to Stay Safe
Vibe coding is the new AI coding trend where anyone can spin up an app in hours. But from Replit’s database wipe to exposed tea apps, the risks are real. Learn what vibe coding security means, the difference from agentic coding, and how CISOs can keep the vibes without the vulnerabilities.
Customer Stories
See how teams like yours are using Aikido to simplify security and ship with confidence.
Compliance
Stay ahead of audits with clear, dev-friendly guidance on SOC 2, ISO standards, GDPR, NIS, and more.
Guides & Best Practices
Actionable tips, security workflows, and how-to guides to help you ship safer code faster.
DevSec Tools & Comparisons
Deep dives and side-by-sides of the top tools in the AppSec and DevSecOps landscape.
The 'no nonsense' list of security acronyms
We list the security acronyms, what they mean and whether AppSec developers should care.
How to Improve Code Quality: Tips for Cleaner Code
Improve code quality by focusing on readability, performance, maintainability, and security. Tools like Aikido security code quality help automate checks, ensuring reliable code.
Reducing Cybersecurity Debt with AI Autotriage
We dive into how AI can assist us in a meaningful way to triage vulnerabilities and get rid of our security debt.
Understanding SBOM Standards: A Look at CycloneDX, SPDX, and SWID
Understand SBOM standards like CycloneDX, SPDX, and SWID to improve software transparency, security, and compliance.
You're Invited: Delivering malware via Google Calendar invites and PUAs
Threat actor used malicious Google Invites and hidden Unicode “Private Use Access” characters (PUAs) to brilliantly obfuscate and hide a malicious NPM package.
Container Security is Hard — Aikido Container AutoFix to Make it Easy
In this post, we’ll explore why updating base images is harder than it seems, walk through real examples, and show how you can automate safe, intelligent upgrades without breaking your app.
RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)
RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)
XRP supply chain attack: Official NPM package infected with crypto stealing backdoor
The official XPRL (Ripple) NPM package was compromised by sophisticated attackers who put in a backdoor to steal cryptocurrency private keys and gain access to cryptocurrency wallets.
Reducing Cybersecurity Debt with AI Autotriage
We dive into how AI can assist us in a meaningful way to triage vulnerabilities and get rid of our security debt.
npm debug and chalk packages compromised
The popular packages debug and chalk on npm have been compromised with malicious code
Top Container Scanning Tools in 2025
Discover the best Container Scanning tools in 2025. Compare features, pros, cons, and integrations to choose the right solution for your DevSecOps pipeline.
SAST vs DAST: What you need to know.
Get an overview of SAST vs DAST, what they are, how to use them together, and why they matter for your application security.
Get secure for free
Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.
.avif)
