Logo
Picture

Vinit Patel @VinRP

Co-founder @Filtered_Tech. Seed investor @Cornerstone_HQ, @Splittable, @Airsorted, @BelAirFood and others. Love olives and @BindaBhudia. filtered.com Mongolia Joined July 2010
  • Tweets
    2K
  • Followers
    569
  • Following
    1K
  • Likes
    431
Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

2 months ago

For years, we could follow this system. CVE reported → maintainer patches latest → you upgrade → you're fixed. So teams got conditioned to always pull the latest. But since then attackers watched and learned to poison it, so if you upgrade the wrong package at the wrong time you might trade a CVE for malware. This is the upgrade trap. @Sooraj_Shah wrote more about how it works and what the way out looks like.

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

2 months ago

Device Protection now supports Windows 🚀 Block malicious browser extensions, IDE plugins, and code libraries. Device Protection gives you visibility and control over the software packages installed on your devices.

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

3 months ago

Traditional malware sneaks onto a machine. Supply chain malware gets invited. The developer runs npm install and the malicious code lands with full permission to execute. That inversion breaks both EDR and proxies at the design level. EDR has no way to tell the difference between malicious code and legitimate code doing the exact same thing. And proxies only work when developers are actually on them, which they often aren't. The scan never runs. Both tools solve real problems for the threats they were designed for. Supply chain attacks just aren't one of them.

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

3 months ago

Full breakdown aikido.dev/blog/exploring…

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

3 months ago

A clean package.json is no longer evidence that nothing runs. The mere presence of binding.gyp is enough for code to run at install time. No scripts block needed. Payloads can hide under any field name, at any depth. The sandbox around it can be escaped. And node-gyp pulls in files automatically that nothing even points to. The latest Miasma variant used binding.gyp. We dug deeper and found it goes much further.

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

3 months ago

x.com/i/article/2061…

VinRP Profile Picture

Vinit Patel @VinRP

4 months ago

@mathewlodge @Xbow @AikidoSecurity Oh and you don't need to pay up front either. Only pay if we find highs/criticals :)

VinRP Profile Picture

Vinit Patel @VinRP

4 months ago

@mathewlodge @Xbow Talk to me or our brilliant team @AikidoSecurity and we'll get you setup in less than 10 mins, and results in <2 hours after that. Or you can do it all yourself in our UI: app.aikido.dev

VinRP Profile Picture

Vinit Patel @VinRP

4 months ago

@__roycohen @grafana it's already happening :scream:

Vinit Patel retweeted
CharlieEriksen Profile Picture

Charlie Eriksen @CharlieEriksen

4 months ago

Somebody appears to be experimenting with a rust-based supply chain worm on npm, in the package `crypto-javascri` virustotal.com/gui/file/56e3c…

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

4 months ago

Update 5:05 PT: The attack has now expanded well beyond @TanStack and @Mistral. 373 malicious package-version entries across 169 npm package names, including @uipath, @squawk, @tallyui, @beproduct, and more. The malware propagates by stealing your CI credentials and using them to publish new compromised versions. Full IOCs, affected package list, and detection steps: aikido.dev/blog/mini-shai…

AikidoSecurity Profile Picture

Aikido @AikidoSecurity

4 months ago

🚨 Update: @MistralAI npm packages are now confirmed compromised as part of the ongoing Mini Shai Hulud attack. Affected versions: @MistralAI/mistralai 2.2.2, 2.2.3, 2.2.4@MistralAI/mistralai-azure 1.7.1, 1.7.2, 1.7.3@MistralAI/mistralai-gcp 1.7.1, 1.7.2, 1.7.3If you use the

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

4 months ago

🚨 Update: Mini Shai-Hulud supply chain attack is back and hit the TanStack npm ecosystem today. At least 84 packages were compromised in two waves starting at 19:20 UTC. @tanstack/react-router, @tanstack/history, @tanstack/router-core, and dozens more across tens of millions of weekly downloads. This is likely from the same TeamPCP campaign behind the SAP npm compromise two weeks ago. If you ran npm install on any @ tanstack package today, treat your environment as compromised. Rotate GitHub tokens, npm tokens, cloud credentials, and CI secrets immediately. Tanner Linsley confirmed affected versions have been unpublished.

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

5 months ago

⚠️A fake tanstack package published four malicious versions between 17:08 and 17:35 UTC today. The postinstall hook reads your .env files and ships them to an attacker-controlled endpoint. If you installed it, rotate everything. We're tracking this actively. Full details: aikido.dev/blog/fake-tans…

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

4 months ago

more here aikido.dev/blog/pytorch-l…

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

4 months ago

🚨 Popular python package lightning was compromised an hour ago. It's already quarantined by pypi. What we know so far: - Versions 2.6.2 and 2.6.3 are compromised - Looks connected to Mini shai hulud stealer/worm attack on SAP and Bitwarden More details soon.

Vinit Patel retweeted
AikidoSecurity Profile Picture

Aikido @AikidoSecurity

5 months ago

Introducing Aikido Endpoint Protection. Developer devices have been under attack. In the last few months alone, Shai Hulud, TeamPCP, Axios, and Vercel were all compromised through developer devices. Aikido Endpoint Protection secures everything your devs install before it reaches the device. Powered by Aikido Intel. Build fearlessly.

VinRP Profile Picture

Vinit Patel @VinRP

3 years ago

@illyism @zenorocha @AikidoSecurity thanks for the shout out @illyism !

VinRP Profile Picture

Vinit Patel @VinRP

5 years ago

@jleeku @useMotion for the win!! 🏅

Vinit Patel retweeted
DaRifRaf Profile Picture

Arif D @DaRifRaf

5 years ago

I think we all know what @imVkohli thinks of the bowler 🤣 #ENGvsIND

VinRP Profile Picture

Vinit Patel @VinRP

5 years ago

V impressed with England’s E.X. Tras batting, has scored 1/3 of Eng’s 2nd innings so far! 🤪 #ENGvsIND #tms

Trends for United States

Durk
Good Saturday
#4ElementsInfiniteBonds
4E OUR INFINITE MOMENTS
Bazardo
Sami
#STARDOM
Severian
gaga
Sally Field
Kansas
Brian Steele
namjoon
Cillian
Mizzou
#SmackDown
Thug
Ben Shelton
#LaGranjaVIP
#AAATriplemania

You might like

Labour Member of Parliament for Southend East & Rochford. Casework & enquiries email - bayo.alaba.mp@parliament.uk.
Bayo Alaba MP
@BayoAlaba
6K Followers
Excited by learning and tech and the stuff in the middle that connects people. I love my bengals. And it's Katherine not Kath (if that's ok). Views are my own.
Katherine Chapman
@KathChapman
2K Followers