SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

n8n Workflow Enables Fail-Closed Vulnerability Scanning for npm and PyPI Packages

0
·1 views

A five-node n8n workflow has been published to help developers scan exact installed versions of npm and PyPI packages for known security vulnerabilities. The workflow queries the OSV API and the CISA Known Exploited Vulnerabilities catalog, using precise version numbers from lockfiles rather than latest tags to reflect what is actually deployed. Unlike fail-open approaches that treat timeouts as clean results, the workflow flags partial or failed source responses as actionable alerts, preventing false negatives from masking real risks. Users can route filtered results to Slack, email, Teams, or a database by replacing a placeholder node after importing the workflow into n8n. The underlying Apify Actor is publicly available and priced at $0.0015 per returned package record, with the workflow export containing no embedded credentials.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Observability Explained: Metrics, Logs, and Traces Are Three Distinct Mechanisms

Modern observability is commonly mistaken for an advanced form of logging, but the two differ fundamentally in how data is emitted rather than how it is analyzed. Metrics are counters held in application memory and periodically scraped or flushed, meaning a million requests generate one counter value rather than a million records. Logs function as discrete events enriched with a trace ID that acts as a linking key across services. Distributed tracing works by copying that trace ID into outgoing request headers at each service hop, allowing a backend to later reconstruct the full request path from independently exported spans. Because the trace ID must be propagated at request time, no retrospective log analysis can substitute for instrumentation built into the request path itself.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer accidentally kills AI coding agent session by renaming its root directory

A developer discovered that asking an AI coding agent to rename its root project directory effectively ended the session without any explicit stop command. The agent successfully completed the rename task, but the IDE and agent session were still pointing to the old, now-nonexistent path. This left the chat input grayed out and unresponsive, silently orphaning the session. The underlying language model itself remained unaffected on its server; only the local execution environment was broken. The incident highlights a quirk of agentic AI systems, which can modify their own operating environment in ways that inadvertently disrupt their own functionality.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Solo founder runs 85 Docker containers for €120/month using 176 custom Bash guards

A solo developer in Germany operates a SaaS ecosystem serving golf clubs and related platforms, running 85 Docker containers across 67 domains on just two Hetzner servers at €120 per month. Each customer receives a physically isolated PostgreSQL database, a deliberate single-tenant design chosen to simplify GDPR data deletion and eliminate cross-tenant security risks. To manage the complexity, the developer relies on AI agents handling roughly 80% of daily operations, constrained by 176 shell scripts that enforce security and operational rules before any command executes. A cron-based watchdog script runs every five minutes to detect and restore failed containers from their last known good state. The setup demonstrates that rigorous automation and strict guard systems can make large-scale solo infrastructure management viable at low cost.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Study Finds Most LLMs Accept False Code Claims, Even With Supporting Context

A developer tested 14 large language models against 50 facts drawn from a 50,000-line Python codebase to measure how often models incorrectly validate false memory claims. The experiment ran two conditions per fact: one where models saw only the claim, and one where they also received code context and supporting patterns. Several models, including nemotron-3-nano and glm-4.7-flash, accepted nearly one in four to one in three false claims even when given supporting code anchors. Top-performing budget models from the Qwen3 family matched Claude's false-accept rate of zero at a fraction of the cost, though all models universally accepted one specific false claim tied to a misleading keyword anchor. The findings suggest that cheap models are not universally reliable for memory verification and that anchor-based prompting can itself introduce contamination risk.

0 comments Read more at DEV Community