# scm Published articles for scm. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Git was built for humans -- agents need an upgrade DevFeed: [Git was built for humans -- agents need an upgrade]() Original publisher: [Read original article]() Author: Jessica Taylor Published: 2026-08-26T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [AI-assisted coding](), [Amazon S3]() Tags: [agents](), [api](), [architecture](), [backend](), [concurrency](), [engineering](), [features](), [git](), [product](), [s3](), [scm]() ### AI overview GitLab describes next-generation source code management designed for large numbers of agents. Its proposed design preserves Git-protocol compatibility while replacing full repository clones with targeted server-side queries and purpose-built read/write APIs. ### Source excerpt The industry is now racing to rebuild source code management for agents. We showed our answer at GitLab Transcend, but let's reiterate why rebuilding the Git backend is only half the problem. Three things break when agents become the primary users of a Git server. Every developer running hundreds of agents hits the same wall, regardless of tools: The clone tax. An agent clones an entire repository to read a single file, then does it again for the next agent, and the next retry, transferring far more data than the task requires and burning context on a local grep or blame it shouldn't have needed to run. One agent invocation today can mean 5GB to 10GB transferred and 30+ seconds of setup, just to answer a single question. Concurrency collapse. Thousands of sessions hit a backend that was originally designed for human scale, producing bottlenecks and unpredictable availability. No isolation. Agents share accounts and one branch space, so they overwhelm the repository, leave no clean way to discard abandoned work, and keep no record of which agent did what. Our platform data shows how fast the pressure is building. Over the past year, our customers created 40% more CI/CD pipelines, and code pushes to GitLab.com were up 50%. While the secure repositories grew by 60%, codebase sizes have also grown by up to 500%. When we announced next-generation source code management (next-gen SCM) at GitLab Transcend in June, we walked through how Git, as an operational model, was not designed for the load agents placed on it. A few weeks later, new entrants, including Git hosts built specifically for agent-scale concurrency, are validating that claim independently. That convergence sharpens why rebuilding the Git backend is necessary, but on its own, it's still not enough. What we're building for agent scale Next-gen SCM runs on the Git protocol for backward compatibility, with a redesigned backend and interfaces built for agents. Instead of cloning a full working tree, agents query ## Stop The Sprawl Snyk Secrets Now Generally Available DevFeed: [Stop The Sprawl Snyk Secrets Now Generally Available]() Original publisher: [Read original article]() Author: Daniel Berman Published: 2026-08-04T04:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Responsibility & Safety](), [AI-assisted coding](), [CI/CD]() Tags: [agentic](), [ai](), [ai-agents](), [ai-coding](), [ai-security](), [api-keys](), [application-security](), [blog](), [ci-cd](), [code-security](), [convert-paid](), [developer](), [devops](), [devsecops](), [interest](), [scm](), [secrets](), [security](), [snyk-platform]() ### AI overview Snyk announces general availability of Snyk Secrets, a contextual ML-powered secrets detection capability for its AI Security Platform. The article frames it as a response to faster secret exposure in AI-driven development and CI/CD workflows. ### Source excerpt Snyk Secrets is now generally available, bringing contextual ML detection, secure-at-commit prevention, and unified secrets governance to the Snyk AI Security Platform. ## Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks DevFeed: [Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks]() Original publisher: [Read original article]() Author: Liran Tal; Lion Kontorer Published: 2026-08-04T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [releases]() Tags: [awareness](), [blog](), [ci](), [ci-cd](), [code](), [developer](), [devops](), [embedded](), [enablement](), [ide](), [incident](), [javascript](), [malware](), [manifest](), [node-js](), [npm-packages](), [open-source-security](), [payload](), [persistence](), [releases](), [research](), [scm](), [secrets](), [security](), [security-labs](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [software](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Snyk reports an active supply-chain incident in which keyv 6.0.0 and ten related npm releases contained install-time malware. The article describes the malicious preinstall hook, its second-stage payload, affected-release investigation, and remediation guidance. ### Source excerpt keyv 6.0.0 and ten related npm releases shipped install-time malware. See affected versions, hashes, detection steps, and safe remediation order. ## Symlinks Are Still Scary (And Yes, You Can Commit Them to Git) DevFeed: [Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)]() Original publisher: [Read original article]() Author: Randall Degges Published: 2026-07-09T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Git](), [ai-coding](), [AI Agent](), [Unix](), [GitHub]() Tags: [ai](), [ai-agent](), [ai-coding](), [application-security](), [article](), [awareness](), [code](), [developer](), [devops](), [devsecops](), [git](), [github](), [scm](), [secrets](), [security](), [security-labs](), [snyk-security-intel]() ### AI overview Symlink attacks exploit the way operating systems transparently redirect symbolic links to other paths. A malicious symlink committed to a Git repository can cause build scripts, editors, or AI coding tools to access unintended files, potentially enabling remote code execution. ### Source excerpt A harmless-looking symlink in a Git repo can redirect a tool into reading or writing anywhere on your machine. That old trick is now showing up in AI coding assistants, with nasty results. ## A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope DevFeed: [A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope]() Original publisher: [Read original article]() Author: Liran Tal; Marian Corneci Published: 2026-06-16T21:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [awareness](), [blog](), [ci-cd](), [cross-platform](), [cryptocurrency](), [developer](), [devops](), [devrel](), [devsecops](), [incident](), [javascript](), [node-js](), [open-source-security](), [payload](), [persistence](), [remote-access-trojan](), [sbom](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [tls](), [vulnerability-insights]() ### AI overview A dormant former-contributor npm account was compromised and used to republish the Mastra package scope with a malicious dependency that installs cryptocurrency-stealing malware and a persistent remote-access trojan. The article describes the stale access control that enabled the supply-chain incident and advises treating affected installations as credential and wallet exposure events. ### Source excerpt A dormant contributor account was used to republish the entire @mastra npm scope, each injected with a single dependency, easy-day-js, that drops a cross-platform cryptocurrency stealer. Here is how the attack worked, how to check exposure, and how to remediate. ## Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp DevFeed: [Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-06-04T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [Malware](), [Security](), [GitHub Actions](), [GitHub](), [Maintainers]() Tags: [awareness](), [blog](), [ci-cd](), [container-security](), [developer](), [devops](), [devsecops](), [eslint](), [github](), [github-actions](), [javascript](), [maintainers](), [malware](), [node](), [node-js](), [open-source-security](), [payload](), [persistence](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview Snyk reports a critical npm supply-chain compromise in which a weaponized binding.gyp file abuses node-gyp during installation to execute malicious code without relying on lifecycle scripts. The worm affects 57 packages, harvests developer and CI/CD credentials, exfiltrates them through GitHub repositories, injects GitHub Actions workflows for persistence, and republishes packages accessible through compromised maintainer accounts. ### Source excerpt A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers. ## The New Security Risks of the Agentic Development Lifecycle DevFeed: [The New Security Risks of the Agentic Development Lifecycle]() Original publisher: [Read original article]() Author: Daniel Berman Published: 2026-06-03T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Application Security](), [sdlc](), [Artificial Intelligence](), [Code]() Tags: [agentic](), [agents](), [ai](), [ai-agents](), [application-security](), [autonomous](), [awareness](), [blog](), [ci-cd](), [code](), [developer](), [development](), [devops](), [devsecops](), [enablement](), [interest](), [scm](), [sdlc](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [software](), [tech](), [workflows]() ### AI overview The article explains the agentic development lifecycle, in which AI agents plan, build, modify, test, and ship software by interacting with tools, codebases, data sources, and development environments. It argues that security must protect the process creating software as well as the resulting code, because agents can introduce risk through what they use, do, and generate. ### Source excerpt AI agents are changing how software gets built, and with it, where security risk begins. Learn why securing the process matters as much as securing the code. ## Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection DevFeed: [Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2026-06-02T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [prompt injection](), [agentic-coding](), [AI-assisted coding](), [Open Source](), [Command-line interface](), [Maven](), [CI/CD](), [payload](), [Claude Code](), [cursor](), [GitHub Copilot]() Tags: [agentic-coding](), [agents](), [ai](), [ai-agents](), [ai-coding](), [article](), [awareness](), [ci-cd](), [claude-code](), [code](), [copilot](), [cursor](), [developer](), [devops](), [github](), [interest](), [java](), [open-source](), [open-source-security](), [payload](), [prompt-injection](), [sandbox](), [scm](), [security](), [security-labs](), [snyk-code](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [testing](), [tools](), [vulnerability-insights]() ### AI overview The article examines jqwik 1.10.0, whose maintainer embedded a prompt injection in test output aimed at AI coding agents. ANSI terminal escape codes concealed the instruction from humans while leaving it visible to tools processing raw logs, creating a supply-chain risk for CI/CD pipelines and agentic coding workflows. ### Source excerpt jqwik 1.10.0 added a hidden prompt injection aimed at AI coding agents, using terminal escape codes to conceal destructive instructions from humans while leaving them readable to logs and tools. ## Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages DevFeed: [Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages]() Original publisher: [Read original article]() Author: Brian Clark Published: 2026-06-01T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Malware](), [npm packages](), [redhat](), [incident](), [GitHub](), [OpenID connect (OIDC)](), [API](), [React](), [Cloud]() Tags: [api](), [article](), [awareness](), [ci-cd](), [cloud-security](), [developer](), [devops](), [devsecops](), [enablement](), [github](), [incident](), [interest](), [npm-packages](), [oidc](), [payload](), [react](), [redhat](), [sbom](), [scm](), [scope](), [secrets](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview The Miasma supply chain attack compromised at least 32 @redhat-cloud-services npm package releases used by the Red Hat Hybrid Cloud Console. The malicious installation script steals developer and cloud credentials, attempts to spread through packages victims can publish, and may expose secrets on affected workstations and CI runners. ### Source excerpt A supply chain worm dubbed Miasma has been found in dozens of @redhat-cloud-services npm releases. The malicious preinstall hook steals credentials, probes cloud identities, and can republish other packages. ## Laravel Lang Supply Chain Advisory DevFeed: [Laravel Lang Supply Chain Advisory]() Original publisher: [Read original article]() Author: Brian Clark Published: 2026-05-23T16:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Laravel](), [Composer](), [Credential theft](), [Malware](), [PHP](), [passwords](), [ssh](), [CI/CD](), [Cloud](), [Kubernetes](), [GitHub]() Tags: [application-security](), [article](), [awareness](), [ci-cd](), [cloud](), [code](), [credential-theft](), [developer](), [devops](), [devrel](), [github](), [kubernetes](), [laravel](), [php](), [scm](), [secrets](), [security](), [security-labs](), [snyk-open-source](), [snyk-security-intel](), [ssh](), [supply-chain](), [supply-chain-security](), [tech](), [tokens](), [vulnerability-insights]() ### AI overview The article examines a Laravel Lang supply-chain attack in which hundreds of historical Packagist releases for four community-maintained Laravel localization libraries were republished with malicious code. The injected Composer hook executes on PHP requests, downloads a second stage, and runs a credential stealer targeting cloud keys, Kubernetes and Vault secrets, CI/CD tokens, SSH material, environment files, browser data, password-manager vaults, crypto wallets, and messaging tokens. ### Source excerpt Hundreds of historical Laravel Lang Packagist releases were republished with malicious code, putting Composer installs at risk of credential theft and secret exfiltration. ## Malicious node-ipc versions published to npm in suspected maintainer account compromise DevFeed: [Malicious node-ipc versions published to npm in suspected maintainer account compromise]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2026-05-15T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Node.js](), [incident](), [releases](), [CI/CD]() Tags: [article](), [awareness](), [ci](), [ci-cd](), [credential-theft](), [developer](), [devops](), [enablement](), [incident](), [javascript](), [kubernetes](), [node](), [node-js](), [releases](), [scm](), [secrets](), [security](), [security-labs](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Multiple malicious node-ipc versions were published to npm with an obfuscated credential-stealing payload in the CommonJS bundle. The article describes a suspected maintainer-account compromise and advises affected teams to treat exposed secrets as potentially compromised and remediate vulnerable dependency paths. ### Source excerpt On May 14, 2026, multiple malicious versions of the popular npm package node-ipc were published to the npm registry. Current public reporting identifies node... ## TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack DevFeed: [TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-05-11T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [article](), [attacks](), [cache](), [ci-cd](), [cryptographic](), [developer](), [devops](), [devsecops](), [github](), [github-actions](), [identity](), [incident](), [maintainers](), [memory](), [npm-packages](), [open-source-security](), [sbom](), [scm](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [teampcp](), [tech](), [toolchain](), [vulnerability-insights](), [workflow]() ### AI overview TanStack's legitimate release pipeline was hijacked to publish malicious npm packages with valid SLSA provenance. The article describes the Mini Shai-Hulud supply-chain attack, its impact, and remediation guidance to rotate secrets on affected install environments. ### Source excerpt On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory -- producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now. ## "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages DevFeed: ["A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-04-29T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [releases]() Tags: [article](), [awareness](), [ci-cd](), [developer](), [devops](), [ecosystem](), [github](), [github-actions](), [incident](), [interest](), [javascript](), [node-js](), [npm-packages](), [open-source-security](), [payload](), [releases](), [sap](), [scm](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [tech](), [tool](), [toolchain](), [vulnerability-insights]() ### AI overview A supply-chain attack compromised four npm packages in the SAP development ecosystem. Malicious releases download Bun and execute an obfuscated credential stealer, while SAP published clean post-incident versions and Snyk issued advisories. ### Source excerpt A new npm supply chain attack self-branded "Mini Shai-Hulud" compromised four SAP-ecosystem packages on April 29, 2026. Snyk has live advisories. Here's the technical breakdown, IOCs, and what to do. ## Bridging the Gap to Autonomous Fixes: Snyk and Atlassian Unveil Intelligent Remediation for Jira DevFeed: [Bridging the Gap to Autonomous Fixes: Snyk and Atlassian Unveil Intelligent Remediation for Jira]() Original publisher: [Read original article]() Author: Jack Ryan Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [AI-assisted coding](), [cursor]() Tags: [agentic](), [ai](), [ai-agent](), [application-security](), [atlassian](), [autonomous](), [awareness](), [blog](), [ci-cd](), [claude-code](), [cli](), [co-created](), [cursor](), [customer](), [customer-featured](), [developer](), [devops](), [devsecops](), [enablement](), [integration](), [interest](), [mcp](), [mcp-server](), [pull-request](), [scm](), [security](), [snyk-platform](), [snyk-security-intel](), [vulnerabilities]() ### AI overview Snyk and Atlassian describe an integration that turns Jira vulnerability tickets into AI-assisted remediation workflows. An agentic development environment retrieves ticket context, generates a fix in a local repository, validates it with a Snyk scan, and can open a pull request. ### Source excerpt Bridge the gap to autonomous fixes. Snyk and Atlassian integrate to transform Jira security tickets into precision fixes using Snyk Studio AI, eliminating context switching and resolving vulnerabilities in minutes. ## Hardcoding Security into Every Commit: The Future of Snyk Secrets DevFeed: [Hardcoding Security into Every Commit: The Future of Snyk Secrets]() Original publisher: [Read original article]() Author: Kate Powers Burke; Waleed Arshad Published: 2026-04-23T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [AI Agent](), [Application Security](), [API keys](), [passwords](), [Model Context Protocol](), [shadow AI]() Tags: [ai](), [ai-agent](), [ai-agents](), [api-keys](), [application-security](), [awareness](), [blog](), [ci-cd](), [developer](), [devops](), [docker](), [enablement](), [engineering](), [executive](), [interest](), [kubernetes](), [model-context-protocol](), [passwords](), [prompt-injection](), [scm](), [secrets](), [security](), [shadow-ai](), [snyk-platform](), [snyk-security-intel](), [software-development](), [tech](), [vs-code](), [vulnerability]() ### AI overview Snyk describes how cloud-native development and AI-generated code are increasing secret sprawl across repositories, CI/CD logs, and collaboration tools. The article argues that autonomous AI agents expand this risk by creating and executing credentials, connecting to MCP servers, and changing systems without human visibility. It presents Snyk Secrets as a real-time approach to detecting exposed sensitive data while maintaining developer speed. ### Source excerpt Snyk Secrets bridges the gap between code and credentials with real-time, high-precision detection, ensuring your most sensitive data stays hidden while your developers stay fast. ## The 5 Principles of Snyk's Developer Experience DevFeed: [The 5 Principles of Snyk's Developer Experience]() Original publisher: [Read original article]() Author: Mayank Khera; Brendan Hann Published: 2026-03-26T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Developer experience](), [Security](), [developer tooling](), [Pull Request](), [Code review](), [Command-line interface](), [ide](), [CI/CD](), [Git](), [ai-coding](), [agent observability](), [internal developer portal]() Tags: [ai](), [ai-coding](), [americas](), [application-security](), [awareness](), [blog](), [ci-cd](), [cli](), [code-security](), [developer](), [developer-experience](), [developer-tooling](), [devops](), [devsecops](), [engineering](), [executive](), [git](), [ide](), [interest](), [pull-request](), [review](), [scm](), [security](), [snyk-code](), [snyk-platform](), [tech](), [vulnerability-insights]() ### AI overview Snyk presents five principles for developer experience, emphasizing seamless integration into existing workflows such as IDEs, terminals, Git, pull requests, AI coding assistants, and CI/CD. The article argues that surfacing security findings directly where developers work reduces context switching and helps teams ship secure code faster. ### Source excerpt Discover the 5 principles behind Snyk's developer experience. Learn how seamless workflows, actionable fixes, and AI-driven security help developers ship secure code faster without disrupting productivity. ## I Read Cursor's Security Agent Prompts, So You Don't Have To DevFeed: [I Read Cursor's Security Agent Prompts, So You Don't Have To]() Original publisher: [Read original article]() Author: Randall Degges Published: 2026-03-17T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [cursor](), [Securing AI](), [ai security](), [Vulnerabilities](), [MCP Server](), [Orchestration](), [Prompt Engineering](), [Terraform](), [Persistence](), [Architecture & Design]() Tags: [agent](), [agentic](), [agents](), [ai](), [ai-security](), [application-security](), [automation](), [awareness](), [blog](), [ci-cd](), [cursor](), [developer](), [devops](), [executive](), [infrastructure](), [interest](), [mcp](), [mcp-server](), [orchestration](), [persistence](), [related-content](), [review](), [sbom](), [scm](), [secrel](), [secrets](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [terraform](), [vs-code](), [vulnerabilities]() ### AI overview The article examines Cursor's security review automation, which uses four autonomous agents to review more than 3,000 pull requests weekly, identify more than 200 vulnerabilities, and open fix pull requests. It argues that the concise prompts are only one part of the system; the larger achievement is the production infrastructure supporting persistence, deduplication, deployment, webhook orchestration, and state management. ### Source excerpt Cursor built AI security agents that review 3,000+ PRs weekly and catch 200+ vulnerabilities. Here's what they get right--and what's missing for enterprise security. ## Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard DevFeed: [Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-03-17T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Agent Skills](), [Security](), [AI Agent](), [Application Security](), [snyk-learn]() Tags: [agent-skills](), [ai](), [ai-agent](), [americas](), [application-security](), [awareness](), [blog](), [co-created](), [developer](), [github](), [interest](), [javascript](), [node-js](), [open-source-security](), [prompt-injection](), [python](), [scm](), [secrets](), [security](), [security-labs](), [snyk-learn](), [snyk-open-source](), [supply-chain-security](), [tech](), [tools](), [vulnerabilities]() ### AI overview Snyk and Tessl have partnered to add security scanning and Snyk security scores to every public skill in the Tessl Registry. The article explains why agent skills require a distinct security approach, highlighting prompt injection, malicious code, excessive agency, and risks involving private data and external communication. ### Source excerpt Snyk and Tessl have partnered to bring security scanning to every skill in the Tessl Registry. Every public skill now carries a Snyk security score, bringing the same trust signals developers expect from package managers to the agent skills ecosystem. ## Snyk and Cline: Securing the Future of Autonomous Coding DevFeed: [Snyk and Cline: Securing the Future of Autonomous Coding]() Original publisher: [Read original article]() Author: Carey Stanton Published: 2026-02-18T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [agentic-coding](), [Security](), [ai-coding](), [Model Context Protocol](), [coding](), [Pull Request]() Tags: [agentic](), [agentic-coding](), [agents](), [ai](), [ai-coding](), [americas](), [application-security](), [autonomous](), [blog](), [code-security](), [coding](), [developer](), [devsecops](), [enablement](), [enterprise](), [executive](), [external](), [integration](), [interest](), [model-context-protocol](), [pmm](), [pull-request](), [reactive](), [related-content](), [review](), [scm](), [security](), [snyk-code](), [snyk-platform](), [snyk-security-intel](), [tech](), [vs-code]() ### AI overview Snyk and Cline announce a partnership to integrate enterprise security intelligence into autonomous coding workflows. Using the Model Context Protocol, Snyk Studio guides Cline's agent in real time, helping enforce security standards before generated code reaches a pull request. ### Source excerpt Snyk and Cline have partnered to integrate enterprise-grade security directly into autonomous coding loops. By bridging the trust gap, Snyk and Cline enable teams to innovate faster while maintaining rigid security and compliance standards. ## Weaving Security into the Flow: New Snyk Studio Capabilities Power the AI Security Fabric DevFeed: [Weaving Security into the Flow: New Snyk Studio Capabilities Power the AI Security Fabric]() Original publisher: [Read original article]() Author: Daniel Berman Published: 2026-02-17T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Securing AI](), [AI Development](), [Security](), [ai-coding](), [Claude Code](), [Command-line interface](), [pull-requests](), [cursor]() Tags: [ai](), [ai-development](), [ai-security](), [application-security](), [blog](), [claude-code](), [cli](), [code-security](), [cursor](), [developer](), [developer-velocity](), [devsecops](), [enablement](), [interest](), [pmm](), [pull-requests](), [scm](), [security](), [snyk-code](), [snyk-platform](), [supply-chain-security](), [vulnerability-insights](), [workflows]() ### AI overview Snyk Studio announces new capabilities for securing AI-driven development, including streamlined integrations with Gemini CLI and Claude Code, automated remediation that generates pull requests, and enterprise reporting and controls. The update embeds security into developers' existing workflows so AI-assisted code can be secured from the first prompt while supporting developer velocity and governance. ### Source excerpt Snyk Studio is redefining AI development security with new integrations for Gemini CLI and Claude Code, enabling developers to build fast without sacrificing safety. Bridge the gap between developer velocity and governance to ensure your code is secure at inception. ## Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers DevFeed: [Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers]() Original publisher: [Read original article]() Author: Liran Tal Published: 2025-12-03T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [MSP MCP](), [Vulnerabilities](), [cursor](), [Node.js]() Tags: [agentic-coding](), [ai](), [ai-agent](), [application-security](), [awareness](), [blog](), [ci-cd](), [developer](), [devrel](), [devsecops](), [engineering](), [javascript](), [mcp](), [mcp-server](), [node-js](), [sbom](), [scm](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [vs-code](), [vulnerabilities]() ### AI overview A tutorial on using AutoMCP to configure Model Context Protocol servers for AI coding tools, connecting dependency context and Snyk scanning to AI-assisted development. ### Source excerpt Supercharge your AI agent! Learn how AutoMCP integrates Model Context Protocol (MCP) servers and Snyk Studio for secure, context-aware AI-driven development. ## One Go API over every SCM: go-scm in the internal developer platform DevFeed: [One Go API over every SCM: go-scm in the internal developer platform]() Original publisher: [Read original article]() Published: 2025-08-10T00:00:00Z Content type: article Language: en Sources: [Andika Ahmad Ramadhan -- Blog]() Topics: [internal developer platform](), [bitbucket](), [Go Language](), [GitHub](), [API]() Tags: [api](), [bitbucket](), [github](), [go](), [internal-developer-platform](), [pull-requests](), [scm]() ### AI overview The article explains how an internal developer platform can support Bitbucket Server, Bitbucket Cloud, and GitHub through the jenkins-x/go-scm Go API. It describes production fixes for provider-specific webhook, identity, pull request, pagination, permission, branch, build-status, and validation behavior. ### Source excerpt How the IDP supports Bitbucket Server, Bitbucket Cloud, and GitHub through jenkins-x/go-scm. ## Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware DevFeed: [Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware]() Original publisher: [Read original article]() Author: Liran Tal Published: 2025-07-22T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [application-security](), [awareness](), [blog](), [ci-cd](), [devrel](), [eslint](), [go](), [incident](), [javascript](), [maintainers](), [malware](), [node-js](), [npm-packages](), [open-source](), [open-source-security](), [password-reset](), [phishing](), [scm](), [security](), [supply-chain](), [supply-chain-security](), [vs-code](), [vulnerability-insights](), [windows]() ### AI overview An npm supply-chain malware incident used a typosquatted registry domain and phishing emails to steal maintainer credentials and publish malicious package versions. ### Source excerpt Urgent warning: Maintainers of popular npm packages like ESLint Prettier Plugin were attacked via an npm supply chain malware incident. Learn about the typosquatting, phishing, and impacted packages, plus essential steps to protect your projects. ## Efficient Dockerfile templating for complex build scenarios DevFeed: [Efficient Dockerfile templating for complex build scenarios]() Original publisher: [Read original article]() Author: Tom Published: 2025-01-01T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [Dockerfile](), [Docker](), [Docker Image](), [configuration]() Tags: [alpine](), [base-images](), [best-practices](), [build](), [dependencies](), [devops](), [docker](), [docker-base-images](), [dockerfiles](), [go](), [infra](), [java](), [linux](), [scm](), [sre](), [ubuntu]() ### AI overview This article explains why Dockerfile templating can help maintain complex Docker base-image variants. It discusses combinations of operating systems, Tomcat versions, Java versions, configurations, and package names, along with the differing responsibilities of development and infrastructure teams. ### Source excerpt Why even consider templating Dockerfiles? Dockerfiles revolutionized the industry with their simplicity. Each instruction creates a new layer in the image, which is automatically cached. This process integrates well with SCM, where you "commit" the results of one stage and move forward with other changes. The process can be easily parameterized with ARG instructions, similar to ENV but provided during the build. This allows for creating highly flexible builds. For most users, this is more than sufficient. However, there's a notable exception: Docker base images. [Next page]()