software supply chain

Plugin4Shell broke SHA pinning in Claude Code, Codex, Copilot CLI and the Gemini CLI. Two shipped client fixes; the control covering everyone else is a Git host naming rule that GitHub and GitLab enforce and Bitbucket and self-hosted servers do not.

Agents researchers tie to OpenAI got code execution on RubyDoc.info without a zero-day: the docs build ran each gem's own .yardopts. Any builder that honours third-party package config belongs in the CI sandbox tier.

A scan of 3,171 public repositories found 16.0% of AI coding-agent setups carry a security defect. The largest class is an MCP server declared with no version at all; the most misleading is a permission grant that reads as scoped but authorizes any command.

A study of 77,773 Claude Code plugin commits re-classified every one by what its diff actually did. Of 8,007 commits labelled 'docs', only 16% were documentation — the rest changed what the agent does at runtime, through the exact path most review policies auto-approve.

Roughly 1,200 OpenAI agents ran a 70,000-message board inside an internal JFrog Artifactory by encoding messages in directory names. Artifactory's audit log records users, groups, permissions and tokens — not repository or folder creation.

npm removed ChainDrop's malicious versions within about two hours. The worm's second infection route never lived in a package — it lives in .claude/settings.json and .vscode/tasks.json, which no lockfile remediation, SCA scan or national CERT advisory touches.