SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

RepoXray: Browser-Based Scanner Flags Supply-Chain and AI Agent Security Risks

0
·2 views

A developer has released RepoXray, a tool for auditing code repositories before installing packages or attaching AI coding agents. It targets 'slopsquatting', where attackers register package names that large language models commonly hallucinate, by checking npm registry existence, package age under 21 days, and OSV.dev advisories. The scanner also flags risky postinstall scripts, plaintext tokens in MCP configuration files, and .env files that coding agents could read. Its web version runs entirely in the browser with no uploads, while the 19 KB CLI, run via npx rxray, has no runtime dependencies. The author is seeking technical feedback on false positives and missing detection rules.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Avoiding PostgreSQL Row-Level Lock Deadlocks Through Ordered Acquisition and NOWAIT

High-throughput systems that update interdependent rows concurrently often hit PostgreSQL deadlocks (SQLSTATE 40P01) or lock timeouts (SQLSTATE 55P03). The article argues that when workers acquire FOR UPDATE locks in inconsistent orders, circular waits form and the database aborts one transaction. Its proposed remedy is to sort lock keys deterministically before querying, which removes circular dependencies. Pairing this with NOWAIT and structured exception handling lets workers fail fast and roll back rather than exhaust connection pools. The piece also includes a Python example that attempts to verify this behavior across threads, along with a runtime dependency installer that the author presents as a convenience.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Meta ends new hardware features for Quest 2 and Pro, but software updates keep improving vision training apps

Meta has announced it will stop adding new hardware features to the Quest 2 and Quest Pro headsets. A developer building a vision training app reports that recent Quest OS updates have still improved performance, including better wrist tracking accuracy and lower jitter. By adjusting the polling interval in Unity's XR Interaction Toolkit, the developer cut gaze-guidance latency from 30 ms to 12 ms. A newer Scene Understanding API let them add real-time obstacle avoidance in about a week without native plugins, also shrinking build size by 3 MB. The developer plans to benchmark each OS update and automate regression testing in CI.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DeeperAI: a Mac, iPhone and iPad app that organizes AI chats into topic trees

DeeperAI is a Mac, iPhone and iPad app that lets users structure a subject as a tree of themes and sub-themes, with Claude available inside each node. Unlike a single long chat history, each conversation stays tied to its topic, so users can resume where they left off. Themes can hold notes and attachments, which are saved in folders mirroring the tree and stay in sync with Finder. The app's AI can suggest sub-themes and emojis, and users can save answers as attachments or import them as subtopics. This first part of a series explains the app's features, while setup is covered in a later installment.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

App Store and Google Play Rejection Checklist for 2025-2026

Many mobile app launch delays stem from failing platform compliance rules rather than code bugs, and reviewers often check these within minutes. Apps that let users create accounts must offer in-app account deletion with a visible button, confirmation, and server-side token revocation, not just a web link or email. Digital goods must use Apple StoreKit or Google Play Billing, while real-world goods and services may use processors like Stripe or PayPal, and paywalls should include Restore Purchases and clear pricing and policy links. Apple requires Privacy Manifests declaring Required Reason APIs, and Android 14+ demands clear, user-facing justification for sensitive permissions such as background location. Reviewers also need working demo accounts with test data and test credentials, such as a static OTP setup, to evaluate the app.

0 comments Read more at DEV Community