Security researchers refine detection of suspicious packages by using AI hallucination timelines.

·1 views

A security team discovered their method for flagging suspicious software packages was generating false positives. Their original system scored packages as high-risk if they were newly registered within 14 to 60 days, mistaking legitimate projects like OpenTelemetry Python for threats. The key insight was that risk should be measured by whether a package was registered *after* an AI model first hallucinated its name, not just by its absolute age. The team adjusted their algorithm to compare a package's creation date against the first recorded AI suggestion of that name. This change correctly reclassified several false positives, including a Rust tool named 'cdx-rs', as low risk.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

TanStack npm supply-chain attack spreads via Dependabot update

On May 11, 2026, a worm compromised TanStack's release pipeline, publishing 84 malicious versions of 42 packages to npm with valid provenance. The attack leveraged a poisoned cache in a GitHub Actions workflow to steal publishing credentials. Hours later, a Dependabot update automatically pulled two compromised versions into an unrelated aviation-data project. When the maintainer merged the update, the worm used his credentials to publish 110 malicious versions of his own packages. The incident affected over 160 packages ecosystem-wide, including those from Mistral, before being contained.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LangGraph recommended as primary Python framework for agentic AI in 2026

A 2026 developer analysis recommends LangGraph as the primary Python framework for agentic AI, citing its explicit graph model and large ecosystem. The Microsoft Agent Framework is advised for Azure-centric infrastructure as it merges AutoGen and Semantic Kernel. CrewAI is identified as the fastest option for prototyping multi-agent teams without production governance. The evaluation notes a migration deadline for Azure users, as Prompt Flow services will retire in April 2027.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tutorial outlines four ffmpeg techniques for creating seamless video loops

The author details methods to eliminate visible cuts in looping videos using the open-source tool ffmpeg. Four techniques are presented, ranging from simple clip repetition to generating custom transition bridges. Each method addresses the problem where the last and first frames of a video do not match, causing a noticeable seam. The tutorial recommends normalizing video source files first to avoid issues with differing formats. These techniques can be performed directly with ffmpeg or through the author's browser-based tool, LoopVideo.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

High-Risk Vulnerabilities Found in 16 Popular Drupal Add-Ons

German cybersecurity agency CERT-BUND issued a high-risk advisory on September 23, 2026, covering 36 vulnerabilities in contributed Drupal projects. The batch of flaws, spanning identifiers from CVE-2026-96355 to CVE-2026-96398, includes risks like arbitrary code execution, privilege escalation, and data manipulation. Sixteen specific third-party Drupal modules, including Webform, Project Browser, and Commerce Decoupled Checkout, are named as affected. Drupal core itself is not impacted, but any installed version of the listed modules below the specified fixed version remains vulnerable. System administrators are advised to update the modules to their patched releases based on an internal inventory.

0 comments Read more at DEV Community