Key findings:
• 1 in 5 have faced a serious breach linked to AI code
• 96% believe AI will one day write secure code
• 65% say false positives are driving risky behavior

Read the full report -> www.aikido.dev/state-of-ai-...

We’re entering a new chapter in pentesting and we’re excited to have the teams from Allseek and Haicker with us on this journey.

Get early access → www.aikido.dev/attack/aipen...

it appears the same attackers also compromised the JavaScript package duckdb (~350k downloads a week):

https://www.aikido.dev/blog/duckdb-npm-packages-compromised

with a combined 2 billion weekly downloads, this is one of the largest supply chain attacks in npm history

• supports-color (287.1m downloads per week)
• strip-ansi (261.17m downloads per week)
• chalk (299.99m downloads per week)
• debug (357.6m downloads per week)
• ansi-styles (371.41m downloads per week)

• error-ex (47.17m downloads per week)
• color-name (191.71m downloads per week)
• is-arrayish (73.8m downloads per week)
• slice-ansi (59.8m downloads per week)
• color-convert (193.5m downloads per week)
• wrap-ansi (197.99m downloads per week)
• ansi-regex (243.64m downloads per week)

• backslash (0.26m downloads per week)
• chalk-template (3.9m downloads per week)
• supports-hyperlinks (19.2m downloads per week)
• has-ansi (12.1m downloads per week)
• simple-swizzle (26.26m downloads per week)
• color-string (27.48m downloads per week)

UPDATE: A massive supply-chain compromise has affected packages with over 2 billion weekly downloads owned by the popular maintainer qix

These include:
• ansi-regex (243.64m downloads per week)
• supports-color (287.1m downloads per week)
• strip-ansi (261.17m downloads per week)

Trag is now part of Aikido. We sat down with Trag co-founder to talk AI, code quality, and what the future looks like. And yes… there was sake involved.

Full episode → www.youtube.com/watch?v=zUxe...