Vinod Tiwari @securient

Here is my most recent project: sci-bot.ru Unlike Sci-Hub and Sci-Net, where I have written all the code manually be hand, this one is pure AI generated - I decided to do this as a kind of experiment. LOVE the result! AI is 50x speedup in code writing, however creating the project is still a lot of work (human input is still needed for architectural decisions, debugging complex functionality and precise instructions) Sci-Bot is connected to Sci-Hub database so it can read research articles and generate answers grounded in science. To pay for generated tokens, Sci-Bot supports two funding models: the first one is standard pay-as-your-go and the second one is legacy from Sci-Hub: it is donation based. Anyone can donate: from these donations, the project will automatically calculate budget for upcoming month, and derive how much AI-generated answers it can serve to users for free.

IDEViewer is the exact solution GitHub needed to solve their extension visibility problem on endpoints. It has single pane of glass view of all IDEs, IDE extensions, its permissions, and extension dependencies. Check it out at github.com/securient/idev… @AikidoSecurity @TheHackersNews @wiz_io @msftsecresponse @msftsecurity

@github Check out github.com/securient/idev…. This tool could have prevented the extension visibility problem and give you a single pane of glass view on who all have the same extension installed on their machines.

@kfirgollan @github @grok I built github.com/securient/idev… to solve the extension visibility and permission problem on endpoints. There is a portal option where you can find who all have installed the particular extension.

you never think this will happen to you, but this happened to me today. a DPRK actor posed as somebody i previously worked with at the arbitrum foundation to have a catchup call. they reached out via telegram, in a channel where we had an existing messaging history. the DPRK actor sent me what looked to be a legitimate teams link, but when i opened it, it said a software update was necessary, which entailed downloading and running a malicious file. in the group call, there was video of everybody on the call, including the person i had previously worked with. stay vigilant and be safe! don’t be afraid to send out your own video conferencing links if you see something suspicious.

keyboard_arrow_left Previous keyboard_arrow_right Next

Tay 💖 @tayvano_

6 months ago

🚨 WARNING (AGAIN) DPRK threat actors are still rekting way too many of you via their fake Zoom / fake Teams meets. They're taking over your Telegrams -> using them to rekt all your friends. They've stolen over $300m via this method already. Read this. Stop the cycle. 🙏

keyboard_arrow_left Previous keyboard_arrow_right Next

145 392 2K 607K 640

@whizwang @tayvano_ This is classic.

@AIHighlight just? Does every tweet need a clickbait title?

🚨 BREAKING: Wiz Research discovered Remote Code Execution on GitHub.com with a single git push The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

Solana traders showing up to buy ETH tokens

@DEFCONCCVillage are you guys returning to Defcon 34?

Sorry to say, Lazarus Group is the top hardworking smart contract security auditor in the world. Other auditors charge $50k and miss critical vulnerabilities. These guys work for free and never leave any money from the contract. Their resume: • Bybit: $1.5 Billion • Drift: $285 Million • WazirX: $235 Million • KelpDAO: $292 Million • DMM Bitcoin: $308 Million • Axie Infinity (Ronin): $625 Million And many others.

"so you staked your ETH on the Ethereum blockchain to earn yield?" "yes, Dave" "except you didn't want your capital to be locked up so you actually staked it with a liquid staking protocol called Lido?" "that's correct, Dave" "and Lido gave you a liquid staking receipt token called stETH in return?" "yes, Dave" "and then you didn't think that was enough, so you juiced the yield even further by depositing your stETH receipt tokens into a restaking protocol called Eigenlayer?" "you are correct, Dave" "and now you didn't want to lock up your capital, so you actually restaked with a liquid restaking protocol called KelpDAO who provided you with a liquid restaking receipt token called rsETH?" "you got it, Dave" "and then that was surely not enough juice, so you then deposited your rsETH tokens into a lending protocol called AAVE so that you could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero whose security is held together by a 1/1 toothpick, which was obviously hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry" "you are 100% correct, dave" jfc.

GitGuardian wrote up the original BSides talk here: blog.gitguardian.com/bsides-sf-2026/ If you're on a security team trying to get a handle on what your devs actually have installed — give it a spin and open issues. Feedback welcome.

Open-sourcing IDEViewer today — the tool behind my BSidesSF 2026 talk on hunting malicious IDE extensions. A single Go binary that scans developer workstations for the supply-chain risk your EDR and SCA can't see. github.com/securient/idev… 🧵

CVE correlation via OSV.dev. SARIF output for GitHub Code Scanning. Real-time fsnotify watchers catch extension installs within 30 seconds. Optional self-hosted portal for fleet visibility. MDM playbooks for JAMF/Mosyle/Kandji. Apache 2.0.

Risk model for extensions: Critical / High / Medium / Low based on activation events, capabilities, and contributes. AI configs get their own score — wildcard Bash(*), plaintext keys, autonomous exec, insecure transports all surface as Critical/High.

What it scans on every dev machine: • IDE extensions across 7+ IDEs (VS Code, Cursor, JetBrains family, VSCodium, Sublime, Vim, Xcode) • Packages — incl. deps bundled inside extensions (invisible to SCA) • AI tool + MCP configs (Claude Code, Cursor, OpenClaw) • Plaintext secrets in .env + git history • Tamper + --no-verify bypass

Thanks for the kind words @PatrickAlphaC , great having you in our council. "I think this is a very valuable role, and it’s something that the Story Protocol does very well. Their security council is often pinged for advice; we discuss industry hacks and open dialogue on how changes in the security landscape should drive action on the Story team. In this scenario, I think it’s important to separate this from a “Security Council” that has defined on-chain roles they often act on, vs. “Security Advisors” who advise on actions." Go read the full article!

Patrick Collins @PatrickAlphaC

2 months ago

x.com/i/article/2042…

10 11 96 9K 53

everyone’s impressed that deloitte is in physical AI now. i’m more interested in why nvidia needs them. distribution is the hard part. nvidia has the stack. they need someone who can actually get it into 500 enterprise clients without it dying in procurement. theaiinsider.tech/2026/03/02/del…

Story v1.6.1 Aeneid Testnet Required Upgrade This release introduces Distributed Key Generation (DKG) and Confidential Data Rails (CDR) on Aeneid Testnet. This lays the foundation for on-chain confidential data management. story.foundation/blog/confident… Upgrade triggers at block height 16332000 (Apr 1, 2026). Only Aeneid nodes need upgrade. Read More ↴