Company
Application security vendor offering static/dynamic analysis and software composition analysis to find code and open-source vulnerabilities.
Attackers hid the malware trigger in the indexed-btree npm package inside a library method, sidestepping the install-script block npm 12 shipped in July. Install-time checks, including a look at package.json for hooks, pass a package that runs its payload on first use.
Reality
Ridge Security's 96-test pen-test benchmark had Claude Opus 4.6 reach 63% coverage at $217 a run, against 52% for Gemini 3 Flash at about $5.42. Ridge argues tooling matters more than the model, yet its published runs held the tooling fixed and varied the model.
Reality
A year on from the CISA and NSA memory-safety report, the adoption evidence is still provider roadmaps and practitioner judgement about C and C++ code that nobody proposes to rewrite wholesale.
Reality
Echo picked up the assets after Minimus decided to close, so this time the customers have somewhere to land. Anyone pinning a base image to one publisher is buying that publisher's rebuild queue too.
Reality
Oasis Security says CVE-2026-65105 lets one malicious page reach the Ollama instance behind a NemoClaw agent and rewrite the template every prompt passes through.
Reality
Attackers moved upstream into the project's own repositories and release workflows, so the attestations checked out. Publisher reputation no longer tells you a build is clean.
Reality