Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

It wasn’t long ago that we uncovered compromised extensions on Open VSX. Now, a new wave of attacks is emerging, and all signs point to the same threat actor. The technique will sound familiar: hidden malicious code injected with invisible Unicode Private Use Area (PUA) characters. We first saw this trick back in March when npm packages used PUAs to conceal payloads. Then came Open VSX. Now, the attacker seems to have turned their sights on GitHub, and their methods are evolving.

TL;DR: Aikido now integrates with Secureframe. Vulnerability data syncs automatically so SOC 2 Type 2 and ISO 27001:2022 evidence stays accurate. 16 tests and 5 controls handled for you. Secureframe makes it easier to run SOC 2, ISO 27001, HIPAA and PCI DSS programs. But compliance tools only work if the data inside them is accurate. Too often, teams end up exporting CSVs, uploading reports, or sharing screenshots that are already outdated by the time an auditor looks at them.