Developer Builds AI Tool to Scan NPM and PyPI Daily for Malicious Packages

·1 views

A developer has launched Authtics Advisories, an open-source system that uses Google's Gemini AI to automatically scan package registries for potentially malicious code. Each day, the tool selects 100 packages from both NPM and PyPI, runs them through an AI analysis pipeline, and generates a report submitted as a GitHub pull request for human review. The developer emphasized that AI findings are not treated as confirmed verdicts — a human reviewer retains final authority before any security advisory is issued. NPM and PyPI scans are staggered roughly two hours apart, with each full scan taking between 30 minutes and an hour to complete. The developer plans to expand coverage to additional registries and is also working on a companion tool called Authtics NPM, which would warn users of potential risks at the point of package installation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DevHandal Batch 2 Introduces Students to Tencent EdgeOne and Web Performance

A student participating in DevHandal Batch 2 was introduced to Tencent EdgeOne Makers, a platform that expanded their understanding of web development beyond just writing functional code. The experience prompted reflection on how published websites must also account for performance, varying user network conditions, and security threats. The student learned that large assets like unoptimized images and unnecessary CSS or JavaScript files can significantly slow down a website, and that edge networking can help deliver content faster to users. Security also emerged as a key concern, with EdgeOne offering traffic management and protection layers for web applications. The overall takeaway was that building a good website requires attention to both code quality and how the site performs and stays secure once it is live on the internet.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo developer details full infrastructure stack powering a transactional email API

A solo developer has published a detailed breakdown of the infrastructure behind Pulsenote, a self-built multi-tenant transactional email API. The platform accepts POST requests, delivers emails via AWS SES, and reports delivery outcomes back to the sender. The stack includes a NestJS monorepo, Kubernetes, ArgoCD, HashiCorp Vault, Terragrunt, LavinMQ for queuing, and three separate frontend applications. The architecture separates the request-acceptance path from the send path to ensure no messages are lost during provider slowdowns or throttling. The developer acknowledges the stack is extensive for a one-person operation and notes which components could be cut for teams still building before acquiring customers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Autonomous AI Coding Agents Now Running Full SDLC Tasks Unsupervised in Production

A Tencent production system called SiriusDeliver is autonomously handling 18,240 data warehouse delivery sessions per month with an 87.2% success rate, cutting median delivery time from 228 minutes to 23 minutes. Unlike AI coding assistants that respond to prompts, autonomous agents can inspect repositories, write across multiple files, run tests, open pull requests, and self-correct from CI failures without human input. Researchers and developers are now coining new frameworks around this shift, including the Agentic SDLC, Spec-Driven Agentic Development, and the concept of a Verification Tax. A longitudinal study of over 43,000 VS Code GitHub issues confirms that developer discourse has moved from code completion quality to agent reliability, configuration, and management. Experts mark 2025 as the start of this third phase in AI-assisted development, following earlier eras of autocomplete and conversational AI tools.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Photos Adds AI Virtual Try-On Feature for Online Fashion Retailers

Google has introduced an AI-powered virtual try-on tool within Google Photos, allowing shoppers to visualize clothing on their own photos before purchasing. The feature uses MediaPipe Pose for body segmentation and Stable Diffusion v2 to render garments with realistic shadows and folds. Google reports a body-alignment accuracy of ±2 cm and claims early adopters saw a 23% reduction in product returns within the first three months. The tool integrates with Google Cloud infrastructure and targets a global fashion e-commerce market exceeding $800 billion, where return rates hover around 30%. Retailers using the API must comply with GDPR and CCPA requirements, including obtaining explicit user consent and offering immediate data deletion on request.

0 comments Read more at DEV Community