Viewing profile — abhisek

GitHub announced this a while back: https://github.blog/changelog/2026-07-28-npm-publish-time-ma...

#2 post on HN currently is: India’s first privately developed rocket reaches orbit on dramatic debut launch. In the same page, there is this news about banning an OSS app, built on…

OpenAI and Hugging Face address security incident during model evaluation - https://news.ycombinator.com/item?id=48997548 - July 2026 (1121 comments)

Hi HN I am the founder of SafeDep. We have been detecting malicious packages for a while. Coming from DevSecOps background, I always considered malicious package detection & protec…

Over engineering is really an NFR of green field projects.

Building Package Manager Guard (PMG) - https://github.com/safedep/pmg With all the supply chain attacks on OSS ecosystems targeting developers, PMG is a practical protection using …

Smells like contagious interview campaign by DPRK folks. They have been doing this for a while. Even using IDE settings, Claude hooks for malicious code execution.

Attackers are just having fun due to abysmal state of npm and some of the insecure design choices by GitHub and GitHub Actions. Every attack gives them credentials which in turn us…

I partly agree. Agents are not going to replace senior devs. Exactly for the internal context and the decision making that comes with it. But senior devs are also expected to have …

Just implemented Landlock + seccomp notify based sandbox in PMG. A tool to protect cli package managers against malicious packages. There were quite a few quirks involved due to Go…

We just analysed the payload. Technical details here: https://safedep.io/malicious-litellm-1-82-8-analysis/ We are looking at similar attack vectors (pth injection), signatures etc…

I have been using superpowers for Gryph development for a while. Love the brainstorming and exploration that it brings in. Haven’t really compared token usage but something in my b…

I think this is the right approach to building sandbox for agents ie. over existing OS native sandbox capabilities so that they are truly enforced. However the challenge is, sandbo…

We found a malicious npm package pino-sdk-v2 impersonating pino, one of the most widely used Node.js loggers with nearly 20 million weekly downloads. The package is a near copy of …

Everybody wants to build infra. Automate something which is known and well understood. Hoping someone else will use it to solve end user's problem which is hard to understand, mess…

110 tools. That’s probably a reason why Anthropic is probably switching to sandboxed code execution over MCPs. It’s just easier to write code and do something specific for a task t…

I see this as “libs” for the agents. They can discover relevant skills by searching a known index, extend their capability for on a given task. While this makes sense for higher au…